Allow Mac codesigning

[lazerwalker]

We allow notarization, but codesigning is a different can of worms.

It's possible our currently flow Just Works™ by subbing in a real production App Store cert instead of a Developer ID Application one. I suspect not, and we need to manually generate an app ID/certificate/etc.

To do after #30, since having a working Fastlane flow will make this way easier.