While Gatekeeper is on by default and the ability to adjust it has been restricted to command-line only in Sierra, it is still possible to disable it.
It's unfortunate that a LetsEncrypt style project can't be done for code signing, due to malware/admin overhead.