Thanks a lot Quinn! I wasn't aware you could sign a file like that.

Yes, when I download the installer and execute it I do go through the replace action.

If I were to run the installer from the container app instead of from the system extension would it work? Im asking because I saw an implementation where the system extension downloaded the pkg installer and then called the helper app to run that installer.

My system extension downloads a pkg installer and executes it with the command shown above. I do this so the user does the app can update itself with no user interaction. The installer copies the app to /Applications and executes the container app.