Hi Mike,
This concept of running the worker and manager privileged is the same as we used for previous versions of NR. The installer needs to make administrative changes but once you've setup a system, and you can do this silently with a script if you'd prefer that, then it doesn't need you to input passwords anymore since it will run as a service in the background. So yes, initially you install and setup but then you should be able to leave it alone. It only asks for credentials if you open the Configurator afterward to change things.
As to signing executables, I just realized that on Windows with KS v7 only the installer is signed and not the executables (like we do on macOS). Thanks for bringing that up! I will fix this right away for the next version of 7.0+.