Isn't emunand GW mode? Can't you run unsigned .cia in emunand?
As lemanuel said, emuNAND is a feature, not GW mode itself. Gateway has two modes: GW mode and Classic mode. You can run both of them without having emuNAND, but anyway, its safer to use one, because if you do something wrong in sysNAND, you may brick your console. As a sandbox, if you do something wrong, you will only softbrick the emuNAND, and you will be able to create another one. Also, you can update your emuNAND to last firmware, and enjoy newer games without update your sysNAND. OK, but emuNAND itself is not able to run unsigned code, because as a copy of sysNAND, it does signature checkings. For that task, you need a way to patch the NAND to avoid that checkings.
For GW users, you can appreciate a difference between modes:
-GW Mode: Allow the use of multi-rom menu. Allows the execution of unsigned code.
-Classic Mode: Allows only the execution of signed code.
For CFW, you can do the same:
-"CFW" mode: pressing L in the boot of emuNAND. Allows the execution of unsigned code.
-Classic mode: not pressing L in the boot of emuNAND. Allows only the execution of signed code
If you see, in Classic mode the emuNAND isn't patched, so the signature checkings are still working.
If you get a Gateway, you can do a little experiment. Install in GW mode an unsigned CIA (most of them are unsigned). Go to classic mode and try to execute it.
A better CFW? Maybe, but AFAIK, CFW is not open-source, so we can only improve it with RE, except if you're yellow8 or if you have access to his code.