When the monkey-patch was added, we were building pyinstaller onefile
binaries; but since then we changed to build pyinstaller onedir binaries
instead. So I believe there are no embedded files inside the main executable
anymore, so doing `codesign --deep *.app` (near the end of make_osx)
should be sufficient.