OS X - Signing installer/application
Apple's signing tools require a keychain containing your organisation's signing identity.

The cert flag on productsign is used to embed an intermediate certificate. It is not used to specify the signing certificate.

It is possible to create a keychain containing your organisation's signing identity. This can then be used to sign your installer using the keychain flag. The separate keychain file can be managed with source code control or other file management tools; it remains separate from the user's login keychain.