> Windows offers several certificate stores on several security levels (AD-domain, machine, user) macOS has different certificate stores and different keychain

> Windows offers several certificate stores on several security levels (AD-domain, machine, user) macOS has different certificate stores and different keychains too. The OP's tool specifically opts to use the "admin" cert store in the system keychain, not user/user (the default for the `security add-trusted-cert` command). Honestly if you take Windows users out of the equation, this whole thing could just be a posix shell script, which would also solve the "verified release binaries" issue, IMO.