Signed but still can't open
While formulating the question, I tried various combinations of keywords and eventually found Difference between “Mac Developer” and “3rd Party Mac Developer Application” on Stack Overflow, which led to developer documentation on Maintaining Certificates which in turn writes this:


  
  Type: Mac App Distribution:
  Name: 3rd Party Mac Developer Application: Team Name
  Description: Used to sign a Mac app before submitting it to the Mac App Store.
  Type: Developer ID Application:
  Name: Developer ID Application: Team Name
  Description: Used to sign a Mac app before distributing it outside the Mac App Store.
  


So apparently this form of code signing is suitable only for submission for the App Store, but not for stand-alone distribution. That took quite a while to work out, so I hope this Q&amp;A will help others avoid that time.