Ok, looks like this is how the new Signed System Volume feature works. Wasn't successful in searching for anything with "com.apple.os.update". Deets here: https://developer.apple.com/news/?id=3xpv8r2m#:~:text=Signed....