I am posting this here instead of on Stack Overflow because this is more conceptual. I am primarily thinking of this a Linux context, but this can be extended to other operating systems.
When I didn't know what I know now about operating systems, I figured that iOS applications signature checked by other programs. I was thinking of real time integrity checks, the kind that occur anytime and every time a resource is accessed. My guess was that these "system" programs could deny the execution of applications with invalid signatures, control their access to files, and deny access to improperly signed resources. I figured other code signature checks on other operating systems like Windows worked the same way.
I have since learned that these integrity checks on iOS devices take place in the kernel. All of the ideas for file integrity that I have seen so far for operating systems like Linux and *BSD leverage the kernel to perform the checks. Is it possible to create a system where non-kernel processes could perform the kind of integrity checks I had in mind when I was first introduced to iOS? Would it require a radically different operating system design for this to work?