We should investigate signing mechanism on Mac 10.12+ to check how it affects javapackager and determine if we can improve anything for these new Mac OS versions.
Currently we need to set the field "Trust->When using this certificate" to "Always Trust"(it requires entering user's password). Otherwise it doesn't allow to sign the bundle. And actually "Always Trust" should be set as a general rule (for "When using this certificate"), not just for "Code Signing" (or it won't work as well, at least on my Mac 10.12.6).