They do list .zip as one recommended way: https://developer.apple.com/documentation/xcode/packaging-ma... But .dmg is also listed as a way to sign the whole thing.