That's insufficient. Code signing doesn't do anything against theft or malfeasance by internal actors. Or external ones, I suppose.

If the software can modify data legitimately, it can be tampered with.