I think this is probably partially a way of indemnifying themselves against any potential problems that users have will malware. There are two outcomes:

• Apple retains gatekeeper prerogative - keeps an eye on any software too problematic
• Brussels says 'No', and Apple can subsequently say 'well we wanted to prevent malware but the EU told us we can't so sorry your phone was compromised, but you are on your own'.

It's just a signing process to verify that it comes from the actual dev from what it sounds like