It looks about right to me. It's warning the user of untrusted software from an anonymous source, and its message should be strongly worded.
If you don't want your users to see that message, make sure your stuff is signed.
If you don't want your users to see that message, make sure your stuff is signed.
"'Facebook' has not been verified by a certificate authority and may damage your computer. You should close this window."
"'Bob Smith' may not actually be the author of this message and the contents may be lies. You should delete this email."
The happy outcome there is users learn to ignore both of them inside of a week.
And, when you type stuff into a textbox and POST it over HTTP, a text box often pops up the first time, saying "This is insecure, fyi".
For text-only emails, it's plenty fine. For emails with images, there's some privacy issues, and for emails with attachments, even more issues.
For the average user that won't check MD5s, saying "This can't be trusted, throw it out" is probably the right idea. There's a lot of history of people telling others their password for a candy bar, so anything that users really want they'll get, scarygram or no.
Essentially, you have to be a real person who can be identified if they produce malware.
AKA every single piece of Mac Software you can download outside the MAS today.
Do people really think that every package that is out there is going to be updated with a signature? Or will people download something, run into this prompt, and turn off the setting? I think the latter.