The Feb 29, 2024 Apple Developer News article titled Privacy updates for App Store submissions seems to clarify that the signing requirement only applies to binary dependencies.