Off course gatekeeper needs to be off once something doesn't have a valid signature. But SIP protects /System, NVRAM, kext loading and some additional stuff. Not user app signatures. Hence my question.