Could you explain more about how the signing setup works?

(That's what held me back most for spending more effort on shortcuts.)

From the repo, it signs natively on macOS and falls back to a cloud signing server (shortcut-signing-server). That fallback matters -- without macOS you would have to reverse-engineer Apple signing format yourself, and it changes across iOS versions. The hosted signing server is really what makes the whole cross-platform toolchain viable.