Extract Installer Package Signing Certificates from xip archive
I think it works with the following command:

xar --dump-toc="${HOME}/Desktop/header.xml" -f /path/to/your/archive.xip

This will write an xml file called "header" onto your desktop, and that one contains the X509 certificates. You only need to parse it; maybe jq will do the job best.

Edit: however, jq isn't native macOS, so it has to be with xmllint etc. This below works. It will put all certificates in your home folder.

FILEPATH="/path/to/your/archive.xip"
FILENAME=$(/usr/bin/basename "$FILEPATH")
/usr/bin/xar --dump-toc=- -f "$FILEPATH" \
    | /usr/bin/xmllint --xpath '//signature[@style="RSA"]' - \
    | /usr/bin/sed -n '/&lt;X509Certificate&gt;/,/&lt;\/X509Certificate&gt;/p' \
    | xargs \
        | /usr/bin/awk '{ \
                gsub("&lt;X509Certificate&gt;","-----BEGINCERTIFICATE-----"); \
                gsub("&lt;/X509Certificate&gt;","-----ENDCERTIFICATE-----"); \
                print}' \
        | /usr/bin/awk '{gsub(" ","\n"); print}' \
        | /usr/bin/awk '{ \
                gsub("BEGINCERTIFICATE-----","BEGIN CERTIFICATE-----\n"); \
                gsub("-----ENDCERTIFICATE","\n-----END CERTIFICATE"); \ 
                print}' \
    | /usr/bin/csplit -k -s -n 1 -f "$FILENAME"-cert - '/END CERTIFICATE/+1' '{3}' 2&gt;/dev/null
for CERT in *"-cert"* ; do
    if [[ $(/bin/cat "$CERT") == "" ]] ; then
        rm -rf "$CERT"
    else
        mv "$CERT" "$CERT.pem"
    fi
done