While I don't think it's perfect, and I don't use it myself, but because it was mentioned in the GP comment I responded to, we can look at the security model of Qubes OS which doesn't rely on its developer to decide what can and can't run on the OS.

Ideally, systems would be designed such that risks are minimized no matter where the app you want to run came from and no matter who signed it. Right now, that's how Apple, Google and Microsoft are dealing with security. They rely on developers signing software with certificates, and they revoke those certificates if they don't want that software to run on their operating systems. There was an incident last year the highlighted this system[1]:

> Last week, just after we covered the release of Big Sur, many macOS users around the world experienced something unprecedented on the platform: a widespread outage of an obscure Apple service caused users worldwide to be unable to launch 3rd party applications. Already being dubbed the “Apple Apocalypse” or “OCSP Apocalypse”, the cause was down to a little-known but essential service called “Online Certificate Status Protocol”

> The purpose of the OCSP call is to check whether a piece of software being launched has had its developer certificate revoked. Revoking developer certificates is one way that Apple deal with known malware. By using an OCSP responder service, Apple hope to prevent any software whose certificate has been revoked from launching on pretty much all Macs anywhere within minutes.

[1] https://www.sentinelone.com/blog/what-happened-to-my-mac-app...