Currently the runner uses keys from keychain while singing the package. Check if producsign comment can accept certificate as base64 for a CI secret instead. This will allow to easily provision new runners if necessary.
Test application update scenario in case we release new versions of the client (check if the app and the daemon got updated)