A lot of actual malware is signed with a legitimate developer ID. Not Microsoft or Adobe's cert, of course, but one that Apple handed out and has not (yet) revoked.