Code signing in general is a terrible industry. Malware authors gladly pay those fees, even for EV code signing certificates, because scamming has high margins

Code signing in general is a terrible industry. Malware authors gladly pay those fees, even for EV code signing certificates, because scamming has high margins. $99 almost seems reasonable until you consider Apple bakes in a mechanism for curation (they own the signing keys, right?). IMHO code signing should be separate from curation systems and should focus on tying code back to a specific individual, not a company. It’s a huge pain to change your identity vs starting a new company to distribute malware. The current systems are built to wrest control of everything. They don’t care about quality or accountability.