How does signing work here? You submit a certificate to Apple which validates who you or organization. Then with your “signed” app, end users can see its source come from you or organization.
The second part is the notarization. This is where you upload a .zip, .pkg, or .dmg to apple and they build a hash of your distribution and serve that to folks through gatekeeper. You can also staple the notarization to the package and then you don’t need to talk to the apple servers.
This way apple can revoke your notarization and users will get warnings about your software being maleware.