I‘m talking about desktop software for personal computers, not infrastructure software or services or anything. I trust the software developer and I trust apple. There’s a signature/certificate chain between those two. It’s fine.

Of course that‘s not acceptable for some people and for some use cases but it is for me.