Emacs signs a Emacs.app application bundle with Apple's codesign utility, using correct default entitlements, and also pre-signing any *.eln files which are in the bundle, as codesign will not detect them as requiring signing even with the --deep flag.

DefaultEmacsEntitlements is the default set of entitlements application bundles are signed with if no entitlements are provided.