See https://extensionworkshop.com/documentation/publish/signing-...
My previous statement was overly broad, but the restrictions do apply to rejected xpis.