You're mixing developing and distribution. You don't need any (meaningful) signing to develop for Android and not even for iOS (although testing is harder there

You're mixing developing and distribution. You don't need any (meaningful) signing to develop for Android and not even for iOS (although testing is harder there). App signing comes in only when end-users are installing your apps. As for malware installation on Librem, that is a separate question. If you don't give apps root access and only install from the repos, you're about as secure as on Android or iOS. Once you start installing from unknown sources, however, it's true that you're screwed - but that's because of the permission system, not signing.