We can probably piggy-back on what I already implemented in [Kuba](https://kuba.mwco.app) and quickly described [here](https://gorilla.moe/blog/ci-sign-and-notarize-binary-apple-macos).
