Hi fastexcel,
Please review the Admin documentation and the policy options for organizations to manage macros: https://docs.microsoft.com/en-us/DeployOffice/security/internet-macros-blocked.
For Trusted Locations - an organization can use policy to choose whether to allow/block Trusted Locations set by users, and can set specific Trusted Locations on their network. Even though the article is for an earlier version of Office, the information still applies to newer versions of Office: http://docs.microsoft.com/deployoffice/security/designate-trusted-locations-for-files-in-office
For digital signatures, only the VBA macro project needs to be signed. Any change to the VBA macro project will require it to be signed again but updating content in the file does not (ex. adding text to a word doc, adding numbers to an excel spreadsheet).