CSSMERR_TP_NOT_TRUSTED for Apple system apps and “No keychain is available” on macOS Tahoe 26.7

Hello,

I’m seeing what appears to be a system-wide code-signing / trust issue on a MacBook Pro running macOS Tahoe 26.7 (25G229).

I originally discovered the issue while preparing to build a local Swift command-line tool. However, the problem is not limited to my own code or to Xcode. Apple system apps fail strict code-signature verification as well.

Environment:

• MacBook Pro, Apple Silicon
• macOS Tahoe 26.7 (25G229)
• Xcode 26.6 (17F113)
• /usr/bin/codesign
• /usr/sbin/spctl

Observed behavior:

1. Strict code-signature verification of Terminal.app fails with:

CSSMERR_TP_NOT_TRUSTED

1. Strict code-signature verification of TextEdit.app also fails with:

CSSMERR_TP_NOT_TRUSTED

1. Xcode 26.6 fails strict code-signature verification with the same error:

CSSMERR_TP_NOT_TRUSTED

1. A Gatekeeper assessment of Xcode fails with:

internal error in Code Signing subsystem

1. Reading trust settings for both the user and admin scopes fails with:

SecTrustSettingsCopyCertificates: No keychain is available. You may need to restart your computer.

1. /System/Library/Keychains/SystemRootCertificates.keychain exists, but read-only certificate queries through the security command did not return an accessible certificate record.

2. The following services are registered and running:

• trustd
• securityd
• syspolicyd

Troubleshooting already performed:

• Restarted the Mac: no change.
• Updated macOS from Tahoe 26.6.2 to Tahoe 26.7: no change.
• Repeated the checks after the 26.7 update: Terminal.app, TextEdit.app and Xcode still fail as described above.

I have intentionally NOT performed any of the following:

• Resetting any keychain
• Deleting or importing certificates
• Changing trust settings
• Disabling Gatekeeper
• Disabling or changing SIP
• Re-signing Xcode or Apple system applications
• Erasing or reinstalling macOS

Apple Developer Support reviewed my description but explained that their support channel is primarily for App Store Connect, app distribution, and Developer account management, and suggested posting the issue here.

My main concern is that this does not appear to be an ordinary Developer ID or signing-certificate issue because Apple system applications such as Terminal.app and TextEdit.app also fail trust verification, while trust-settings queries report that no keychain is available.

Questions:

1. What additional read-only diagnostics would you recommend to determine why the macOS trust/keychain subsystem cannot establish trust even for Apple system applications?

2. Is there an Apple-supported way to verify the integrity and accessibility of SystemRootCertificates.keychain and the system trust store without modifying or resetting the keychains?

3. Does the combination of CSSMERR_TP_NOT_TRUSTED for Apple system apps and “No keychain is available” from SecTrustSettingsCopyCertificates indicate a known trust-store/keychain problem?

4. Before considering a non-destructive macOS reinstall from Recovery, are there additional safe diagnostics I should perform?

I would prefer not to reset keychains or manually modify certificates unless there is evidence that doing so is appropriate.

I can provide the exact commands and full outputs from the read-only diagnostics if that would help.

Thank you.