In The Packaging Tool User's Guide section:
Sign the Application Package (macOS)
1.) The example used default type , which on Mac is "dmg", which only requires the "Developer ID Application: developer.example.com" certificate (as described all good), but it should mention that to sign a "pkg" type the "Developer ID Installer: developer.example.com" certificate is also needed.
2.) The doc should now say that s signed "dmg" or "pkg", or a zip file made from an "app-image" is suitable for notarization.