I'm interested in knowing when the key used to sign one of my macOS applications has changed after an update. How can I get information about which developer certificate was used to sign a given application/binary?
Note that I don't really trust the name on the certificate. I'm worried about people who game Apple's processes to get issued a legitimate developer cert, possibly with a duplicate—or at least plausible—name on them. I'm more interested in getting something like an SHA-256 hash of the developer cert used to sign a given binary.