The key is in understanding that the trade off is an illusion. App signing is de facto blacklisting. Anyone can get an app signed but Apple maintains a naughty list. It's just anti-virus by another name.

But you don't need signed apps for that, only hashes. And you don't have to phone home for that, only download the latest naughty list whenever it changes so you can check against it locally.