So the situation is even worse than I thought? I mean, it is technically possible to install untrusted extensions, using xcode's self signing, but it isn't exactly straight forward and/or easy.
Xcode is used for Safari App Extensions. Safari Extensions like RES are created in Safari's Extension Builder, which apparently balks without a signing certificate.