Well, I would love to know how to change the bundle layout to have to sign less.

My notes are here: https://www.patreon.com/posts/34472331

You can take the same Apache-NetBeans-11.3-bin-macosx.dmg and see how you could submit it with your own key.

I guess there may be different rules on a .pkg vs .app in a DMG but it seems silly since the user gets the same bits on disk.