From the repo, it signs natively on macOS and falls back to a cloud signing server (shortcut-signing-server). That fallback matters -- without macOS you would have to reverse-engineer Apple signing format yourself, and it changes across iOS versions. The hosted signing server is really what makes the whole cross-platform toolchain viable.

I wonder if https://crates.io/crates/apple-codesign is sufficient to codesign these. Apple usually re-uses these sort of things.