Exercise 2: Signing Is Not the Same as a Malware Check — Possible Solution
====================================================================

WHY THIS CONFLATES TWO SEPARATE THINGS
------------------------------
Per this chapter, code signing and notarization answer two genuinely different questions. Signing proves the binary hasn't been altered since it was signed, and identifies which developer or organization actually signed it - it says nothing about whether the code itself is malicious. Notarization is the separate, automated check that actually looks for known-malware signatures and basic policy violations. An app can, in principle, be validly signed (proving a real, identifiable developer built it and it hasn't been tampered with) while still failing or never undergoing notarization - signing alone provides no malware guarantee at all.

WHO PERFORMS EACH ONE
------------------------------
Signing is done by the developer themselves, using their own private key issued as part of a Developer ID certificate. Notarization is done afterward, automatically, by Apple's own servers - no human reviewer is involved, and it happens only after the developer has already signed and uploaded the app for scanning.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly separates "proves who built it and that it's unaltered" (signing) from "checks whether it's actually malicious" (notarization), and correctly identifies the developer as the one who signs versus Apple's own automated servers as the ones who notarize, rather than treating the two as one combined step performed by the same party.