In case it is helpful for anyone else, we "resolved" the problem by putting the signing code into a batch file and retrying the timestamp a few times if it fails.
signtool sign /a /v /sm /s my /n "Company" /d "Software Name" "installer.msi" signtool timestamp /t http://timestamp.verisign.com/scripts/timestamp.dll "Software Name" "installer.msi" if ERRORLEVEL 0 GOTO END signtool timestamp /t http://timestamp.verisign.com/scripts/timestamp.dll "Software Name" "installer.msi" if ERRORLEVEL 0 GOTO END signtool timestamp /t http://timestamp.verisign.com/scripts/timestamp.dll "Software Name" "installer.msi" :END