You should download signed and notarized framework directly from vendor. If it is not possible, you have to sign it yourself (with your certificate), but there are lot of challenges because you must know which entitlements this framework need (vendor's documentation might help).