... it took a couple searches to figure out that "extreme codesign" wasn't actually code-signing, but "co-design" like "stuff that was designed to work together"
Maybe it's caused by `codesign` tools? Like `codesign --extreme` which probably requires two signers to sign one thing?