Something like that. But it’s also a option to whatever tool cmake is calling. (IIRC the apple option is

--sign

but I don’t know what’s up with cpack)