Hooray! I am glad to be wrong. For others looking to test this, $ codesign -dv /Applications/xyz.app ... Sealed Resources version=2 rules=13 files=

Hooray! I am glad to be wrong. For others looking to test this, $ codesign -dv /Applications/xyz.app ... Sealed Resources version=2 rules=13 files=122 ... For version=2, all resources are signed.