You know what's even easier than getting a signing certificate for malware? Not bothering with signing at all. And revoking a cert for one "dev" does not mean

You know what's even easier than getting a signing certificate for malware? Not bothering with signing at all. And revoking a cert for one "dev" does not mean revoking everything, as for them stealing signing keys from other devs (not typical users, but security literate) how often does that happen, especially in the case of apple with sandboxing etc?