It’s often a nesting/dependency problem which is hard to solve after the fact.
A website may depend on libraries, which depends on other libraries. They must all be signed. They are all interlinked against a known version during build, and signing them after linking may not be an option.
The website may offer a download, which is probably a setup file of sorts, which must be signed. It will of course contain binaries, which must be signed too.
The website itself may also be something packaged in another setup file, which too must be signed.
Now how do you “just” sign something like that before releasing to prod? You don’t.
Signing (and time stamping!) must be a intergrated part of every step of the build process.
It takes more work than you would expect to get this done properly, systematically and reliably for every part of your build process. It does take effort and expertise.
That said, for certain build-types (like pure CI) we disable things like timestamping. We’re not crazy :)
