The signing missing isn't a major effort. You can turn it off easily with spctl via ssh or allow an app for example. Same with windows domains if you have confi

The signing missing isn't a major effort. You can turn it off easily with spctl via ssh or allow an app for example. Same with windows domains if you have configured a root CA for your organisation. Even metro apps can be side loaded/self signed on Windows enterprise edition. Agree with your second point entirely.