Answer : there doesn't seem to be any way to do this in Matlab compiler (at least, as of 2016b which I'm currently using).
I worked around it by using the Windows program signtool.exe (part of Visual Studio) explicitly after compilation.
Something like this:
% compile
mcc('-m','-R','-startmsg', ...
'-d', outfolder, ...
'-v',source,'-o',strrep(target, '.exe', '')); % compile. mcc wants the target name without the .exe
% sign
system([ 'signtool.exe sign /f MYCERT.pfx /p MYPASS /t http://timestamp.verisign.com/scripts/timstamp.dll /v ' outfolder '/' target ], '-echo');