This is all by design, and you're surely right about Apple doing more with code signing in the future. In the past, signatures have mostly only been checked in very specific circumstances (e.g., designated requirements for two programs to be considered equivalent by Keychain and the firewall), though the architecture is fairly general, so third parties have been free to cook up their own applications. Still are, though there is no alternative to Developer ID for the Gatekeeper checks, which seems sensible from a KISS perspective, so long as reasonable workarounds exist for developers unwilling or unable to sign with a Developer ID (certainly true today).