The items inside are signed. I also checked it with "codesign --verify -v" with a positiv result: " Nomonyx dominicus.vst3: valid on disk Nomonyx dominicus.vst3: satisfies its Designated Requirement "