We have same problem in our company. We have to sign all plugin bundles included in the main app bundle with the same certificate that is used for singing the main app bundle.

Because *.meta files break required bundle layout -> there can not be *.meta file in the root of the bundle directory structure. So at first *.meta files must be removed from the bundle.
Bellow is a bash command to remove all *.meta from the bundle.
> $ find "<path_to_bundle>" -type f -name *.meta -delete
Do the same for all bundles in the main app bundle
> $ find "<application_bundle>" -type d -name *.bundle | while read line;
do
echo -e " - Found plugin bundle - $line"
echo -e " - Cleaning unity *.meta files from plugin bundle ...."
find $line -type f -name *.meta -delete
done;

It will be nice if Unity will not modify (do not add*.meta files) content of the native plugin (bundles) for macOS.
Currently, it is a little bit tricky to automate the build of the production app version of the Unit macOS app :( .You need to hack all required signing of app notarization etc. Hopefully, it will get better in the next release of Unity.

The meta files cause codesign to fail.

With the hardened runtime and library validation, it's required that the plugins not only are signed correctly but also are signed with the same Team ID as the main bundle. It's therefore required to resign all plugins.

The meta files make this more tedious, because they have to be removed before signing can succeed.

I've got the same issue. An easy fix is to remove .meta manually before signing.