With our current setup, we use the --deep option, which should be avoided. This tool signs bundles in the "correct" way as recommended by Apple (each Mach-O individually, from the inside-out).
