Yessss Thank you @ibamba - in my case, I had a "Developer ID Application" certificate, and I needed to download "Developer ID - G2 (Expiring 09/17/2031 00:00:00 UTC)" from that website.

How exactly does this work? Searching the contents of Transporter.app shows no "altool"

Thank you, sstanley, using altool found inside Transporter.app did the trick. How exactly does one do this? Searching the contents of Transporter.app shows nothing called altool