This is why the Mac Gatekeeper is an awesome idea. Unfortunately they fucked up the implementation. Also they are the only CA so they can control who signs apps or not.