In the ETSI 3.3.1 SOL007 Option 2 of package security, the signature of the NSD signed package should have the extension .cms, not .sig.cms.

Currently that is the structure of the package: 

package.zip
--package.sig.cms
--package.cert
--package.csar

 The .sig.cms is only for internal artifacts of the package.csar. But for the csar signature itself, should have the same base name as the CSAR with the .cms extension.

From the ETSI 3.3.1 SOL007, section 5.2:

The signature file shall have an extension .cms and the same name as the CSAR file.

 Introduced in SDC-2614.