Debuggers are special--the OS won't let unsigned binaries control other processes, no matter how they came to exist on your system.
Outside of that, Gatekeeper applies to executables fetched from the Web, can be disabled (harder on Sierra), and is easy enough to bypass--and you only have to do it once per executable. If signed, the certificate does need to be trusted to count--otherwise, it'd just be a fancy checksum.
Alright. This sounds like something we should be
eventually doing. Not sure if we should prioritize
it right now. GPG-signing the binaries for
extra verifiability is another thing we
could do in the meantime, though it doesn't fix the OSX issue.
Outside of that, Gatekeeper applies to executables fetched from the Web, can be disabled (harder on Sierra), and is easy enough to bypass--and you only have to do it once per executable. If signed, the certificate does need to be trusted to count--otherwise, it'd just be a fancy checksum.