Looking at the productsign stuff right now, I’m confused about why it needs a

--keychain

argument. At least in localdev, it searchs the keychains.