apply signature in productbuild, not pkgbuild

Merge to release branch.