How to make new certificate recognised?
Copy the certificate to the client (in DER or PEM format), then run:

sudo security add-trusted-cert -d /path/to/certificate


At least, that works for SSL certificates; I haven't tried it for code signing.  You might need to add -p codeSign or something similar.  Also, this sets a trust policy for the certificate, but doesn't actually add it to the system keychain.  If you want it to appear there as well, you also need to run:

sudo security add-certificate -k /Library/Keychains/System.keychain /path/to/certificate