It seems like you can sign binaries with non-apple provided certificates:
https://developer.apple.com/library/archive/documentation/Se...
This github issue (https://github.com/goreleaser/goreleaser/issues/835) mentions: So, the sign pipe is supposed to be generic enough so it could be used with different signing mechanisms
Not tried this but it looks like its possible