App signer works ok, with both new (xcode 11) and old (=<xcode 10) certs. Have just been able to double check all this. Sign the topshelf appex inside the ipa (plugins/kodi-topshelf.appex) first using your topshelf provisioning profile, and then sign the ipa app using the app provisioning profile and select "ignore plugins folder".
For those doing full builds:
I had issues with xcode 11 doing full builds with the new certs, but ive spent a bit of time rechecking my certs/profiles, and can confirm that xcode 11 (and new dev certs) work fine without any code changes.
My example cmakebuildsys call is
cpp:
make -C tools/depends/target/cmakebuildsys CMAKE_EXTRA_ARGUMENTS="-DPLATFORM_BUNDLE_IDENTIFIER='net.domain.kodi' -DDEVELOPMENT_TEAM='X1XX123X1X' -DPROVISIONING_PROFILE_APP='net.domain.kodi - xcode 11' -DPROVISIONING_PROFILE_TOPSHELF='net.domain.kodi.topshelf - xcode 11'"
Note the profiles were made in dev portal and called what i have above, one for each app and topshelf, with the group added for "net.domain.kodi". Certificate was made with the "For use in Xcode 11 or later" setup. Development Team ID can be found via Keychain Access, find your developer cert, right click get info and then "Organisational Unit". Should also be the text string in the cert name "Apple Development: Team Name (teamid)"
Didnt have to remove any existing xcode 10 profile/certs to have it work.
Do note, when i didnt provide any cmake arguments, and then tried to allow xcode 11 to "automatically manage signing" i always had trouble, and it wouldnt work. Your mileage may vary though.