That’s why I buy Macs! /hj (Though I do install and use Arch BTW on my M2 MacBook Air)

Yes and no. Yes, it has to be signed, but no, it doesn’t have to be Apple’s signing, it can be ad-hoc signed for the device programmatically. What they’re doing is that removing that ability to remove quarantine bits and ad-hoc signing on installation and forcing everything to be Apple-signed.

EDIT: Ad-hoc signing is compile-time. Quarantine bit just has to be removed at install-time.