You don't need to sign applications, but applications need to request permission to access the tracker, use dbus etc. This is done by including a .aegis file in your .deb package that uses an XML-like syntax.