Answer : there doesn't seem to be any way to do this in Matlab compiler (at least, as of 2016b which I'm currently using).
I worked around it by using the Windows program signtool.exe (part of Visual Studio) explicitly after compilation.
Something like this:
      % compile
      mcc('-m','-R','-startmsg', ...
         '-d', outfolder, ...
         '-v',source,'-o',strrep(target, '.exe', ''));  % compile.  mcc wants the target name without the .exe
      % sign
      system([ 'signtool.exe sign /f MYCERT.pfx /p MYPASS /t http://timestamp.verisign.com/scripts/timstamp.dll /v ' outfolder '/' target ], '-echo');


