They work just fine. The signing check is performed exactly once for new software. Once allowed, it's never checked again. As nothing on an upgraded system is "new", it works without ever showing a Gatekeeper prompt.

It's basically identical to the "You just downloaded this file from the web, are you sure you want to run it?" check built into Safari - the file quarantine system http://support.apple.com/kb/HT3662?viewlocale=en_US&loca.... However, this defaults to "No" for unsigned code, and "Yes" for signed code.