On macOS Sierra and later, spctl can be used to assess a disk image's signature, like this:
$ spctl -a -t open --context context:primary-signature -v MyImage.dmg
/Users/me/Downloads/MyImage.dmg: accepted
source=Developer ID
$ hdiutil create -volname [volume name] -srcfolder [source folder] -format UDZO -fs ExFAT -ov [image filename]
$ hdiutil verify [image filename]
$ pkgutil --pkgs # list all installed packages
$ pkgutil --files the-package-name.pkg # list installed files
$ pkgutil --pkg-info the-package-name.pkg # check the location
$ cd / # assuming the package is rooted at /...
$ pkgutil --only-files --files the-package-name.pkg | tr '\n' '\0' | xargs -n 1 -0 sudo rm -i
$ pkgutil --only-dirs --files the-package-name.pkg | tr '\n' '\0' | xargs -n 1 -0 sudo rm -ir
$ sudo pkgutil --forget the-package-name.pkg