I think it would be find to sign it wherever it is in codesign, and then move it to an app bundle, and sign that. which is what I assume the packaging code does. But that was what I was testing.