Signing an app for potential notarization requires specific entitlements.
A default set of such entitlements will be included in a resource file (which can be overridden by the resource override mechanism), but it would be better to also have command line options to set entitlements:
--mac-entitlements <file path>
    entitlement file to use for signing.