I've read the man page, but I'm having trouble understanding what the -o kill flag does to the codesign tool. I initially interpreted the sentence "Code with the kill flag set will die when it loses its identity" to mean that if you sign an app with the kill flag, and then change the app in a way that invalidates the signature, then the OS will no longer run the app. That would be nice, and I've seen blog posts indicating that other people believed that. But experiment shows that it doesn't do that. So what does it do?