(almost) everyone has an SSL certificate for the web. An OS could check if software is signed with one. And maybe display a warning for only domain validation.

What does software being signed signify? Does it mean it's vetted? Can a malware author pay the $X and have their malware signed?

No, Apple will detect and suppress malware as part of the vetting process.

Ah, so they do vet? I didn't realize, thanks.