Code signing wouldn't necessarily fix that. There are a lot of "legitimate" applications that a user wouldn't want. For example, spyware is fine if there's some plausible deniability to it because many applications do some form of spying nowadays.