[fathyb]

> I don’t know if signatures are verified before or after running but the binary probably won’t even run without being signed by a paying Apple Developer anyways.

It's before. You can code sign and verify macOS binaries with any certificate you wish, including a self-signed one (useful in case you want your private iTerm fork). Note the plugin should be signed with the same certificate as the iTerm app [1], just using a paid account won't work.

[1] https://gitlab.com/gnachman/iterm2/-/blob/b0e6b336a6be9bca00...