Signing bins as part of your build chain seems easy to me.
It's also a potentially dangerous first step towards forcing new versions of MacOS to only run code from verified developers - those that pay Apple. Again, trivial for commericial development, but a major issue for non-commercial use.