Essentially, yes. The OS enforces that an app bundle is signed by a cert that was issued by Apple.
Without going through Apple at all, the only option is jailbreaking, to bypass the signing check. No one's figured out (publicly) how to jailbreak the last two major versions, though, as far as I know (there were some jailbreaks that worked for iOS 11 betas).
Another option still involves getting a cert from Apple, but it's free. You just need to create an Apple ID. The limitation here is that you have to re-install the app (IIRC) every seven days.
