it's fine for most people, allowing for only signed applications in an app store is a good thing for, you know, people like my siste or mom aka 99% of users. having some accountability and being able to trace an application back to a users/organization signing it is a long term win.
The problem is that Apple is the one and only gatekeeper here. $99 for a lot of apps, like independent games made for a competition, is a very high barrier to entry. Were Apple to allow third party certificates, and/or use the existing ecosystem for software signing certificates, there would be a lot fewer issues with this.
I agree that Apple should not be the (sole) one signing apps for their OSes.
However, I doubt a dialog "this app was signed by 'Evil Privacy Invaders, inc'. You haven't trusted their software before. Do you want to do that now?" would deter the typical user from clicking 'Yes, always'.
So, the best they could do is allow a fixed set of regulated code signers. I do not see how that would be much of a change from the current situation.
/I/ should be the gatekeeper on /my/ device. Apple's all or nothing approach means that for hobbyist usage, or internal app distribution, etc, you still have to pay that $99/year, even if it's not going into the regular ecosystem.
