Convoluted enough to scare the average people off from installing apps outside from the app store.
In theory, code signing is a positive thing, and probably should be part of Linux too. In practice, it becomes an expensive paywall, that often pushes developers to make web applications instead (browsers don’t have to check for code signage), both on Mac and Windows.
Note that this is only with unsigned apps. You can download other apps and run them just fine as long as they’re signed.
Much confuse. Such convolute. Wow.