>One important change with those new models is that they require all ARM-native executable code to be signed, unlike Intel models which can continue to run unsi

>One important change with those new models is that they require all ARM-native executable code to be signed, unlike Intel models which can continue to run unsigned code in Big Sur. If you read the linked article it notes that there is no requirement for the signature to be signed by anybody and that the linker automatically adds one one the fly. This is similar to Android app development.