No subject

"""
--keychain filename
    ...
    Note that _filename_ will not be searched to resolve the signing
    identity's certificate chain unless it is also on the user's
    keychain search list.
"""

I think you misunderstand this sentence. codesign will search in this
keychain for the certificate itself, but the keychain will not be used
to find other certificates in the certificate chain (all intermediates
up to a root CA). With a self-signed certificate, there is no additional
certificate in the chain.

Rainer