A possible solution seems to be to not use the --deep option but rather do the codesign in 4 stages:
# sign all the dylibs.
codesign -f -s 'MyID' MyApp.App/Contents/Frameworks/*.dylib
# sign the A version of Xojo's framework
codesign -f -s 'MyID' MyApp.App/Contents/Frameworks/Frameworks/XojoFramework.framework/Versions/A/XojoFramework
# sign the wrapper for the framework
codesign -f -s 'MyID' MyApp.App/Contents/Frameworks/Frameworks/XojoFramework.framework
# sign the app
codesign -f -s 'MyID' MyApp.App