This was never resolved properly. My Developer ID Certificates exist in two places within KeychainAccess: (correct) from "login" in MyCerticates (incorrect) from "system" in Certificates I tried to clean this up, but found that from the GUI, when you say to delete the Certificate in the incorrect location, it also deletes the one in the correct location. I accepted the status quo (2 copies of Certificate). The Codesign tool (embedded within the jpackage script) gives a warning "two copies found of the certificate, choosing to use the fist one". Because of that failsafe feature, I was able to complete all my codesigning. With that, this thread is closed.

see https://developer.apple.com/forums/thread/792821