The osx-sign callback returns before signing finishes, so the share extension signature raced the main app signature.