OK, Apple recommended to verify the signing with this:
codesign -vvv --deep --strict "/Users/Hans/Library/Audio/Plug-Ins/VST3/Art Vista Intonator i.vst3"
which I did, but evidently the binary still isn’t signed. Every time I try to sign, I get the message that it is already signed.
When doing the verification above I received:
/Users/Hans/Library/Audio/Plug-Ins/VST3/Art Vista Intonator i.vst3: valid on disk
/Users/Hans/Library/Audio/Plug-Ins/VST3/Art Vista Intonator i.vst3: satisfies its Designated Requirement
Can an adhoc signature be replaced with a proper signature? Or maybe if I delete the binary, make some changes to the new JUCE project and build a new plugin. Can I avoid the adhoc signature?
What if I use this to sign with my developer ID:
codesign --force --timestamp --verbose --sign <sign-id> <file>
https://forum.juce.com/t/solved-plugins-automatically-signed-incorrectly-during-build-on-macos/52690
Would this be the way to do it?
codesign -s --force —verbose "Developer ID Application: Hans Adamson (ABCDE12345)” "/Users/Hans/Library/Audio/Plug-Ins/VST3/Art Vista Intonator i.vst3" --timestamp
But the question is why it was signed with adhoc in the first place…