We have found a way for him to unsign it but it is not documented in 'manual' and we are not sure this is recommended.
We cannot sign the customizable content, as our user will corrupt it and break the signature. customizable content that our user will modify maybe sign and notarize
We are distributig our application package as a DMG.