How does macOS identify the signing status of an app downloaded from the Internet? I downloaded an app from the Internet using Safari. Upon executing it, macOS notifies that the app is from an unidentified developer.

How is macOS able to determine this information? Where is the signing metadata for an app stored?
The information is stored within extended attributes, with additional information potentially embedded within an application.

Extended Attributes

This quarantine information is stored as an extended attribute. Use the xattr tool to view the attributes associated with a file or application.

The attribute causing this message is com.apple.quarantine.

See How do I remove the “extended attributes” on a file in Mac OS X? and App can't be opened because it is from an unidentified developer for more details.

Gatekeeper and Code Signatures

The extended attribute is used by Gatekeeper on macOS and is discussed in How to set (restore) the com.apple.quarantine attribute?

A optional digital signature embedded within an application is used to determine the application's developer. If a signature is not found, macOS presents the application as being from an unidentified developer.