a) Money is a bit of a red herring. Or rather, if Apple gave away keys for free, would you no longer have a problem?
b) If you have physical layer access, you can override any security settings. Gatekeeper et al cannot change this fact. You will be able to write/run code, just not necessarily distribute it.
c) Code signing will nuke a large portion of malware. 99% of users are not developers, so why should the default state of the operating system be configured for our needs?
d) Code signing could be implemented on a javascript level, as well. Flash is/was an attempt at signed codebases/binaries distributed over the web. Presumably, for example, a site could required to pull resources from an HTML5 manifest style local cache that has been signed/verified. This could eliminate MITM style attacks (changing ads) that are already in use. Difficult? Yes. Impossible? No.
e) There's always Linux/BSD. Until the TPM security protocols of 2018 are implemented, of course.
Don't forget UEFI, which has the potential to make a large segment of consumer devices unbootable under linux and also invalidate your point b). If you think that walled-garden software signing is in the future, why wouldn't you expect that signing to be implemented straight down to a hardware level?
b) If you have physical layer access, you can override any security settings. Gatekeeper et al cannot change this fact. You will be able to write/run code, just not necessarily distribute it.
That is not necessarily true. It is a "simple"[1] matter to have non-overridable security programming arbitrarily close to core hardware, from a chip on the motherboard to etched directly into the same silicon as the processor or BIOS. This isn't just a theoretical concern: plans to do this are already underway, see http://en.wikipedia.org/wiki/UEFI#Secure_Boot
[1]: By "simple" I mean the concept is simple, the implementation is plenty complicated.
This is tangential to your arguments, but code signing doesn't enter the Flash platform until you start targeting native apps instead of the web. Flash has no code signing; only AIR does.
a) Money is a bit of a red herring. Or rather, if Apple gave away keys for free, would you no longer have a problem?
b) If you have physical layer access, you can override any security settings. Gatekeeper et al cannot change this fact. You will be able to write/run code, just not necessarily distribute it.
c) Code signing will nuke a large portion of malware. 99% of users are not developers, so why should the default state of the operating system be configured for our needs?
d) Code signing could be implemented on a javascript level, as well. Flash is/was an attempt at signed codebases/binaries distributed over the web. Presumably, for example, a site could required to pull resources from an HTML5 manifest style local cache that has been signed/verified. This could eliminate MITM style attacks (changing ads) that are already in use. Difficult? Yes. Impossible? No.
e) There's always Linux/BSD. Until the TPM security protocols of 2018 are implemented, of course.