Probably a compromise could be to keep developer "notarization" but multiple number of authorities, like we're already doing with SSL certs.

Imagine how internet would look like of we had just a single authority issuing SSL certificates.