The author seems to have written this article in a very web-centric way, as if "API" could only possibly refer to web service APIs that go over the open interne

The author seems to have written this article in a very web-centric way, as if "API" could only possibly refer to web service APIs that go over the open internet. But of course sometimes (you might even say often) APIs don't go over a network at all and don't cross the sort of boundaries that require signing. For example, the Linux kernel has an API that applications can use. There's no need for the response to open(2) to be signed. If you can't trust the result, you can't trust anything else that is happening either since you are at the mercy of the kernel.