I've never worked anywhere that _doesn't_ allow their engineers to run unsigned code. It's good practice for non-techs, but if your engineers need to be babysat like that, get better engineers.