and when malware is discovered in the rare case of signed apps signing can be revoked
Signature revocations are functionally equivalent to malware definitions and correspondingly don't actually require code signing.
alt Hacker News
Signature revocations are functionally equivalent to malware definitions and correspondingly don't actually require code signing.