Thanks, Quinn. We followed your advice for Apple CLT Python3.framework. Both codesign --verify --strict --deep and an explicit requirement (identifier "com.apple.python3" and anchor apple) passed outside our restricted sandbox. gktool scan reported: "Scan completed and software is allowed by system policy." The earlier CSSMERR_TP_NOT_TRUSTED remains unexplained, not evidence of a bad signature. Your guidance was very helpful.

Thanks, Quinn. We followed your advice for Apple CLT Python3.framework. Both codesign --verify --strict --deep and an explicit requirement (identifier "com.apple.python3" and anchor apple) passed outside our restricted sandbox. gktool scan reported: "Scan completed and software is allowed by system policy." The earlier CSSMERR_TP_NOT_TRUSTED remains unexplained, not evidence of a bad signature. Your guidance was very helpful.

Thanks, Quinn. We followed your advice for Apple CLT Python3.framework. Both codesign --verify --strict --deep and an explicit requirement (identifier "com.apple.python3" and anchor apple) passed outside our restricted sandbox. gktool scan reported: "Scan completed and software is allowed by system policy." The earlier CSSMERR_TP_NOT_TRUSTED remains unexplained, not evidence of a bad signature. Your guidance was very helpful.