Just that now the linker automatically signs every binary. So that something like gatekeeper could disable it based on the signature.
That would be my non-"apple is draconian" interpretation, as I don't have an arm mac.
That is not the same as it signing "every binary", otherwise there would be no point in signing in the first place.
I'm not sure how I feel about it, personally. I think code signing is a great idea. I just don't believe this single authority approach is the way to do it. I totally understand that as you already trust apple to provide the OS, it makes sense that you can trust them to sign apps - but that shouldn't mean you cant (as a user) choose to trust other parties.
Of course, they don't actually check the apps aren't malicious - they don't even check that you are a real person when you create a dev account... But they do have a signature they can revoke if your software is exposed as malware.
They also say >enable the system to better detect code modifications.
So that part doesn't require any central authority and can be handled locally. (But I'm guessing there are more parts)