How to add Sudo Insults with TouchID without disabling SIP

Question

I am following a guide to recompile sudo with insults. However, I felt uncomfortable disabling SIP so I modified it a bit to allow me to use it with SIP enabled. Unfortunately recompiling sudo broke my ability to authenticate sudo using TouchID. I investigated this and discovered it had to do with the entitlements codesigning used by sudo.

If you look at the Entitlements for sudo: sudo cp /usr/bin/sudo . && sudo codesign -d --entitlements :- ./sudo* you get:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.private.AuthorizationServices</key>
    <array>
        <string>com.apple.security.sudo</string>
    </array>
</dict>
</plist>

Apparently this com.apple.private.AuthorizationServices key is necessary to the enabling of TouchID for sudo.

Proof: ./sudo ls prompts me for TouchID ✅

sudo codesign --remove-signature ./sudo && sudo -k && ./sudo ls does not prompt me for TouchID and just asks me for my password ❌

Is this only because I continue to have SIP enabled? Does disabling SIP remove the code signing requirements for TouchID?

Edit 1: Attempts at fixes: What I am trying to do is just remove the code signature from a copy of /usr/bin/sudo and allow TouchID with that (so I can be sure any error isn't coming from recompiling)

1. Make an editable copy of /usr/bin/sudo to work with: sudo cp /usr/bin/sudo .
2. remove code signing sudo codesign --remove-signature ./sudo
3. Try to re-apply entitlements sudo codesign -d --entitlements :- $(which sudo)>entitlements.plist. && sudo codesign --entitlements entitlements.plist -s "signature" ./sudo
4. Try to execute ./sudo and see if it prompts for TouchID: ./sudo ls prints [1] 12559 killed ./sudo ls

So the process is immediately being killed. I'm guessing macOS is noticing an improperly signed executable and killing it. What is the proper way to enable TouchID on ./sudo?

Edit 2: Does anybody know where I can find logs to help track this? Console.app just says

com.apple.libsqlite3    error   14:44:27.950193 -0400   taskgated   cannot open file at line 42270 of [95fbac39ba]
com.apple.libsqlite3    error   14:44:27.950216 -0400   taskgated   os_unix.c:42270: (2) open(/var/db/DetachedSignatures) - No such file or directory

Trying to run sudo dtruss ./sudo is weird. It will give me 1 of 4 error messages each time it's run:

1. dtrace: failed to control pid 13256: process exec'd set-id or unobservable program

2. Failed to read dyld info for process 13279 (4) dtrace: failed to control pid 13279: process exec'd set-id or unobservable program

3. dtrace: failed to execute ./sudo: Could not create symbolicator for task

4. Failed to read dyld info for process 13833 (4) dtrace: failed to execute ./sudo: Could not create symbolicator for task

Edit 3:

trying to verify the code sign signature seems to be okay

sudo codesign --verify --verbose  ./sudo
./sudo: valid on disk
./sudo: satisfies its Designated Requirement

spctl says it is rejected, but doesn't give a reason why

sudo spctl -a -vvvv ./sudo
./sudo: rejected
origin=Mac Developer: [email protected] (is the UUID private?)

compared to /usr/bin/sudo

sudo spctl -a -vvvv $(which sudo)
/usr/bin/sudo: rejected (the code is valid but does not seem to be an app)
origin=Software Signing

So even Apple's sudo is rejected, but it says the code the valid (I'm guessing spctl is only for app bundles (like .app)). Since it doesn't say ./sudo is valid, I'm guessing that means it's invalid, but I can't make it give more information