Turns out turning off code signing is harder than it looks