Can you use document scans bought on black market to bypass this?

Why otherwise would end-users trust individual developers or tiny orgs, esp. from countries without much rule of law? What else gives your users assurance a binary isn't bundled with adware, malware, trojans, or privacy compromises, either now or won't sneakily be at any time in the future when the developers might cash out to some unknown org, or else simply want to generate a sneaky new revenue stream without their users' informed consent?

Suggesting an umbrella organization give the primary assurance of trustworthiness is similar to what SourceForge used to do, until their practices destroyed their reputation back in 2013, and also greatly damaged the reputations of legit developers who used their site. [https://en.wikipedia.org/wiki/SourceForge#Controversies]

[1]: "A Cautionary Tale from the Decline of SourceForge" [https://news.ycombinator.com/item?id=31110206]

[2]: "Why SourceForge Lost" [https://news.ycombinator.com/item?id=2739995]

[3]: https://hn.algolia.com/?q=sourceforge

Do what mobile OS do and make the app ask for permissions just before it needs to do something special. Make it impossible to ask for root. Sandbox apps.

Linux distributions package applications (including binary ones) for their users, why can't macOS or Windows do this? Run automatic safety checks on them before deploying updates to users. The Windows Store and Apple's App Store (on macOS) are kind of like that, but they only have applications that developers chose to put there. I don't see Linux distributions asking developers for permission to package their application (there are proprietary packages on Arch and NixOS), so I don't see why Apple couldn't do the same.

Certificates are a bureaucratic half-solution.

macOS already does all of that for all programs. I think the main problem here is that macOS only protects certain directories and not others. Programs can request access to Documents or Downloads, or they can request full-disk access (e.g. to read Library/Messages).

For unprotected directories like Library/Keychains, programs can just copy the encrypted database. Since the malware obtains the keychain password with a fake password prompt, it can decrypt the database.

That's an aspiration. It's not what Android does these days. Mobile OS permissions (at least Android) have become pretty weaselly. Protecting you from malware blatantly asking for root is obviously very important. Sandboxing is important. But the sneakier use of permissions for privacy exploits and data harvesting is different and more subtle.

GasBuddy ("GasBuddy Is a Privacy Nightmare")[0] is a case in point. Geolocating users and selling that to everyone. Harvesting users' driving habits then selling those to Allstate subsidiary Arity ("turning mobility and driver data into meaningful behavioral insights, leveraging telematics to make transportation smarter, safer, and more useful for everyone!"). (But there's an opt-out!)

So are fitness apps and trackers. Private equity loves acquiring them.

Permissions can be abused in ways that aren't made obvious to users. Obvious example: just because you disable "location access", doesn't mean the app can't (indirectly) geolocate you in a variety of sneaky ways.

Even if the app doesn't intentionally crash if you disable its location access: indirectly geolocating users indirectly from IP addresses or metadata on photos they upload. Device fingerprinting from motion sensors, so that you can track a unique user across networks and devices, and develop "behavioral insights". And on and on.

[0]: https://news.ycombinator.com/item?id=30636730

How does signing dox you? It doesn’t really include much in the way of identifiable information

Your idea would defeat the purpose of signing , which is to trust the delivery. If a company was sharing their signing certificate, nobody would know it came from you, and it would take just one malicious person also using that certificate to get everyone’s apps pulled.