Your comments

I'm not surprised at all. It seems like they want all extensions to go through their process.

I believe they want free development for future features by using developers code submitted along with their extensions.

I've submitted extensions in the past where they have been rejected since they might not work on a cloud instance due to possible issues in the code. These issues are completely irrelevant with our on-premise setup but the extension still would not get signed. A small example is included external DLL files (such as NewtonsoftJson) for easier JSON handling - not possible since the extension would never work on a cloud instance where you don't have access to include these files.

If they really wanted us to have our own extensions, they would allow all custom extensions for on-premise installs and only cloud instances require a signed extension