If I try to build the release binaries, then sign them, then re-run the

--target package

the binaries are re-generated/linked and we lose the signature