If you trust all of your packagers, you can have one trusted code-signing cert for everyone. Please password protect it, though! Otherwise, you have less trusted packagers use a self-signed test code signing cert with a limited lifespan. A gatekeeper owns the production cert and resigns the package for production. Production machines only trust that cert. The key is that the subject name (a string like CN=company) has to match.