When you download an app through a browser, it will set a quarantine file system attribute. By default, clearing this bit requires the app to be notarized. The

When you download an app through a browser, it will set a quarantine file system attribute. By default, clearing this bit requires the app to be notarized. The user can also right-click open to allow an app to run, add a third-party certificate as trusted, or disable Gatekeeper altogether from the command-line. I believe Catalina also will be periodic checks to make sure the binary hasn't been modified. If you don't distribute software off of your own machine, you do not have to think about signing at all. The rust installation manager and cargo do not set the quarantine attribute, so there is nothing for quarantine to check when binaries are run.