Yes and no. Yes, it has to be signed, but no, it doesn’t have to be Apple’s signing, it can be ad-hoc signed for the device programmatically. What they’re doing is that removing that ability to remove quarantine bits and ad-hoc signing on installation and forcing everything to be Apple-signed.