before enabling Secure Enclave wallet require code be signed with a certificate

[spoonincode]

On ARM macOS, every application must be signed. And Apple really means that: when you cc hello.c -o hello the linker adds an "ad-hoc" code signature to the output (this is not to be confused with Ad Hoc Distribution Profiles; something else entirely in the Apple code signing space).

When the Secure Enclave wallet code starts up (which is included in every macOS build), it performs a simple check to see if the executable is signed before granting access to the Secure Enclave wallet (an application needs to be signed to have proper entitlements to access the Secure Enclave). Well, this ad-hoc code signature is indeed a code signature so this check passes and shows the Secure Enclave wallet in keosd even when you can't use it (because an ad-hoc signature isn't going to have the proper entitlements).

Extend the check a little further to check that the executable isn't just signed but that the code signature is made with a valid certificate. Apple states

If the code was signed using an ad-hoc signature, there are no certificates at all and all certificate constraints evaluate to false. An ad-hoc signature is created by signing with the pseudo-identity - (a dash). An ad-hoc signature does not use or record a cryptographic identity, and thus identifies exactly and only the one program being signed.

(emphasis mine), and indeed in my testing this simple change worked as expected: ad-hoc signed applications will not pass this new check but even a self signed developer application (the "lowest tier" of signed applications that can get Secure Enclave access) passed this check.

Also add Mac Studio ids to the whitelist since I'm still unaware how to query for Secure Enclave support. (I did no recent research though)

Of course, our Secure Enclave support feels more like a tech demo as a signed keosd has never been shipped by B1 nor ENF, and signing it yourself requires considerable knowledge. But it's not really getting in the way at the moment so might as well leave it in for now.