Quinn, thanks for the cogent explanation. There do appear to be some issues with the approach you outlined (as a non-expert, of course). Alas, I will need to fit it into a bit larger space in a full reply as opposed to a comment. See below.

Drewbadour, I don't want to sign code for distribution beyond registered machines. I want to debug code in the "Development only. Distribution approval required." model that Quinn described, but for the devices that my client builds. Of course, these are restricted entitlements, just as the others are that are already on offer. I hope that these are not considered uniquely untouchable for some reason.