First you need to download the signing private key and certificate from Apple (this is in the form of a ".p12" file). Quill can attach the full certificate chain at signing time with the Apple root ...