There is no other reasonable way to implement that feature that would scale across Apple's customer base. If you don't like it, they provided the third option ("Ignore all this code signing stuff").
There is a way. Allow at least one more certification authority. Let, say, Verisign sell code signing certificates for OS X. This will ensure that Apple is not the only party in control of which software runs on Macs.
I have the third option, but I will also have to explain this option to the users of my software. Plus, the option is not granular -- it seems like you cannot disallow all unsigned software, but make exceptions.
Here, let's try just one response and you just (safely) assume that it stands in for a myriad of other similarly horrible issues:
Likelihood that Apple will sell its CA root key to an unnamed Fortune 500 company under NDA to make some kind of software rollout problem simpler for them at the expense of the security of every Mac computer in the world? Zero.
Likelihood that an SSL CA will, after sucking the intestines out of a freshly killed puppy dog using its razor sharp SSL CA proboscis, sell its CA root key to an unnamed Fortune 500 company under NDA to make some kind of software rollout problem simpler for them at the expense of the security of every Mac computer in the world? Not zero. Not close to zero.
> Let, say, Verisign sell code signing certificates for OS X.
How many security breaches has Verisign had? Allowing 3rd party authorities to issue certificates would simply weaken the security that the feature provides. Moreover, it would mean that Apple cannot revoke the certificates, defeating the entire point of the feature.
> it seems like you cannot disallow all unsigned software, but make exceptions.
That would be a pretty broken feature. The only ways for OS X to handle that would be for it to say "screw it, I don't care what's in this specific directory, you can run it", which means that the directory becomes a vector for malware, or to disallow updating the directory once you exclude it, so that the OS can be sure that what you allowed is actually what's running. Both of these are pretty terrible options.
