Attached the sysdiagnose and crash report files to the bug report

No, it's packaged in a .dmg that the user downloads from the browser every time it needs to be run

I mean it's a one-time run application without an installer. But yeah we investigated setting up the lauchd service and found that it would not work with the setup we have.

Without user interaction? No, that would be a clear violation of platform security policies.  Of course not without user interaction. Ours is a runtime application so implementing a lauchd daemon was not viable last we explored this. We use the SFAuthorization API to escalate privileges where required. The SFAuthorization class gives us an Authorization object that we can pass with other functions. Is there a way we can utilize this Authorization object with the keypair creation?

Is there a way to do this programmatically? SecKeyCreateRandomKey or SecKeyCreatePair do not accept an Authorization object and running the entire application as sudo is not an option