trying to understand the --no-exec activate option (on by default?)

[Fred Wright]

On Thu, 29 Nov 2018, Ren? J.V. Bertin wrote:

> The default for this option should be OFF IMHO; there are also ports 
> which do important things in the post-activate; the lldb ports remind 
> the user that an executable needs to be code-signed for instance. 
> Evidently this has to be done each time the port is (re)activated.

In the particular case of code signing, would it be possible to do that in 
the post-destroot phase, so that the signature would remain across 
activations and deactivations, or does the signature mechanism defend 
against that (even though a verbatim copy of signed code should still be 
signed)?

Fred Wright