You can produce two signed binaries, one for <10.11 that is signed with a SHA-1 and one for newer systems that is signed with SHA-256. Your update framework wou

You can produce two signed binaries, one for <10.11 that is signed with a SHA-1 and one for newer systems that is signed with SHA-256. Your update framework would have to know which one to pull, but that seems surmountable.