For code itself, which is what this change affects, code signing is verified by the kernel at page-in time. Combined with W^X, there's no way to bypass it. Ve

For code itself, which is what this change affects, code signing is verified by the kernel at page-in time. Combined with W^X, there's no way to bypass it. Verifying associated resources is done separately by userland and is a somewhat messier process.