You need to sign the .app with .entitlements, as well as all the binaries inside, before packaging the .pkg. The binaries inside that I sign are:
setplugpath.mxo (I use this because I use vst~ in my app)
You will likely have to sign the ReWire stuff as well.
Let us tell you about notable Max projects, obscure facts, and creative media artists of all kinds.