Xojo signs the app if you configure it.
If you do it manually you need to first sign the stuff in the /Frameworks folder inside the app and then app itself.
Next you make a dmg via Script or DMGCanvas (or similar) and sign that, too.
Then notarize it with the Apple service via app or script.
If you are not comfortable with scripts and Terminal, check an app like App Wrapper.