I've never used code signing, and I'm not really sure how it works. Do you need to submit your source code or binaries to the signing organization? How are th

I've never used code signing, and I'm not really sure how it works. Do you need to submit your source code or binaries to the signing organization? How are they checked? How is code signing supposed to prevent Eve from just paying for a cert, then writing a program that steals your data or crypto ransomware? What if Eve pays with a prepaid debit card or a stolen credit card?