https://wiki.mozilla.org/Add-ons/Extension_Signing#FAQ
The FAQ says that in ESR, xpinstall.signatures.required should be respected but this is out of date IME (ESR 115).