I would like to manually verify the certificate chain on a package from my MacOS Catalina. I know that you can use the codesign --extract-certificates to extract certificates from applications, but I can't find an alternative for packages (through pkgutil etc). Can anyone help? Thanks in advance :)