From the repo, it signs natively on macOS and falls back to a cloud signing server (shortcut-signing-server). That fallback matters -- without macOS you would have to reverse-engineer Apple signing format yourself, and it changes across iOS versions. The hosted signing server is really what makes the whole cross-platform toolchain viable.