Yes. Agreed. But on the other hand Apple has taken conscious action to put themselves in the position where you have to go through them to get an attestation if you have customers who use Mac OS. They chose not to trust any attestation other than their own, you cannot choose to have Microsoft, or Red Hat, or IBM, or any other trusted vendor (e.g. https://www.sigstore.dev/ or something similar) attest and verify your software and your developer identity.