Based on our conversation with @clee46:
We found in the attached log, that xamarin-archive step were using our default development code sign files:
Code Signing Key: "iPhone Developer: Bitrise Bot (REDACTED)" (REDACTED) Provisioning Profile: "BitriseBot-Wildcard" (REDACTED) Bundle Id: REDACTED
This means the app was signed with our default code sign files.
To totally disable our default code sign files, clear the default_certificate_url, default_certificate_passphrase, default_provisioning_profile_url inputs of the certificate-and-profile-installer step.