[saagarjha]

Again, is this something specific for graphics drivers? Because I can write a driver today, sign it with my developer certificate, and distribute it to others without Apple’s approval; if I have blanket preapproval my users can install it without disabling SIP as well.

[Hackbraten]

A standard developer certificate won’t help you for drivers (except for drivers that purely run in user space, such as FUSE filesystems).

Anything that is a kext (kernel extension) requires a special kernel signing developer certificate so macOS will allow users to install it without disabling SIP. Apple is extremely conservative in handing out those kext certificates, and even if they grant you one, they will impose super harsh restrictions on what you can do with them.