Better handling of mac-specific properties

[bhearsum]

I think these work, but ideally we'd have some sort of warning that if we're running macapp, we need to define some of these. And if we're not running macapp signing, none of these are valid. We could do this in a number of ways:

• define a schema for macapp vs non-macapp
• put these options in a format-specific dictionary that we define schemas for for each signing format
• put these three if statements under an if format_ == "macapp": block, or similar

We don't necessarily need to block on this but we may want to track the issue at least.

Originally posted by @escapewindow in #23 (comment)