App Store submit error ITMS-90035

ios ARKit app on UE 4.21 PC:

Local device deploy works, creating .ipa file works fine. I swear to god provisioning and certificate are good for distribution and created the right way and include one another, but I’m getting this error:

ERROR ITMS-90035: “Invalid Signature. Code failed to satisfy specified code requirement(s). The file at path [ARKitTest.app/ARKitTest] is not properly signed. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose “Clean All” in Xcode, delete the “build” directory in the Finder, and rebuild your release target. For more information, please consult About Code Signing

UE 4.21 from PC using a imac with XCode 10.1 for remote compile.
Provisioning and Certificate are for distribution not development.
App is basically based on the Unreal ARKit demo app, everything before distribute to App Store works fine.

What could it be?
I highly suggest UE PC be able to create .xarchives over remote compile, they can be tweaked in xcode in such cases. The PC Unity guys here are getting xarchives out of XCode.

Try re-signing the IPA using the iOS Packager tool in the Engine/Binaries/DotNET folder.

Thanks for the hint to look closer at the iOS Packager tool.
If I try to specify an explicit certificate, I get a “key not available” error. What does it mean? The .cer file needs a .p12 key-file? I own them for all certificates, how do I specify it? It does not ask me for the path. Or does it mean a key inside the .plist? Which one?