zpool binary, and all its .dylibs, are signed and notarized. Hopefully correctly, but let's leave a little room for the possibility I got something wrong.I need to think up a good way to test the issue, since it appears to trigger at boot (when it is supposed to import the pools), from launchd. I believe when run by hand after a user logged in, all is well. Could it be running too early, before the OS has a chance to verify certificates?I found I had to leave "mount_zfs" unsigned for mount_root - or it would fail to mount root at boot time as it was unable to verify the teamID. But that is unrelated I think.