Signing of OS X binaries is done via the copy-sign-bundles script. But it relies on the certificate already being installed on the OS X machine used for signing. We do not make sure it is using the same certificate that is present in the ctc tree. We should update the script to load the proper certificate on each run, making sure it is up to date.