Security in this context is a red herring, it's PR nonsense. We solved the most common vectors of malware when code signing was thought of a generation ago. The

Security in this context is a red herring, it's PR nonsense. We solved the most common vectors of malware when code signing was thought of a generation ago. The problem is only Apple has cared to loosely implement it, and refuses to do it on mobile even though you can do it yourself on Mac. The double standard is clear: you can run whatever you want on a "computer", but not your "phone" even though phones have far better permissions and protection systems. We can solve this today if the big players will join in - neutral party code signing. Anyone can provide identity to get a dev key, they get to sign their software. If their software is malicious there's all kinds of evidence of who they are and various agencies very interested in it.