How do I add iCloud entitlements to Mac games?

Our game uses Objective-C++ to communicate with Apple’s CloudKit, which works flawlessly on tvOS and iOS. However, Unreal does not add the entitlement to use iCloud when packaging games for Mac, so calls to iCloud fail on that system.

I’ve tried manually adding the entitlements myself using codesign as described in this forums post. When I don’t modify the entitlements, codesign seems to successfully sign my code and the application can launch.

However, when I try to add the entitlements while signing the code, the resulting .app fails on launch with a code sign error. The console logs:

/Users/.../mygame.app/Contents/MacOS/MyGame signature not valid: -67050
proc 11928: load code signature error 4 for file "MyGame"

When I try and validate the signature for gatekeeper I get:

$ codesign --verify --deep --verbose=4 MyGame.app/
MyGame.app/: valid on disk
MyGame.app/: satisfies its Designated Requirement
$ spctl --assess --verbose MyGame.app/
MyGame.app/: rejected

Does anyone have experience modifying the entitlements of packaged Unreal Mac apps? What should we try next?

I would also like to know the answer to this.