The identity codesign should use and the keychain that holds it.
codesign
The keychain is null for ad-hoc signing, which needs none.
typedef SigningIdentity = ({String identity, Directory? keychainHome});