Steam is its own client. Only Steam would need to be signed/verified. It doesn't have to set the gatekeeper bit for the software it downloads (like your web browser does), although it could and just allow the same GK process to occur with each game.