Move closer to the way Mozilla is signing macOS bundles
Mozilla is using a bash script codesign.bash for signing macOS bundles. We should go over it and include the finer-grained signing (different entitlement files being used and sometimes entitlements are not even ready) into our setup.
(see: https://bugzilla.mozilla.org/show_bug.cgi?id=1593071 for important changes to that bash script)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information