[misnome]

Oh, no there are a few of things here, and I think I got slightly confused. There is local signing, which I believe is short term - e.g. your own machine and device, which doesn't require paying anything to apple for a developer membership. This is for on-device testing.

There's also Ad-hoc signing, which I believe is longer-lived, requires a developer account, but has restrictions on how many people you can send it to.

As an enterprise user you can also distribute apps yourself to company employees without going via app store verification, though I think it's much harder to get onto this program https://developer.apple.com/programs/enterprise/ . This is what has occasionally been abused, I don't know how the certificate is revoked centrally though, but it's not for [user] self-compiled code.

It's possible that my knowledge of this is slightly off, because it was a few years since I worked with this stuff.