Brief rundown of how Apple Push Notifications (APN) work:
- Generate a keypair, generate a CSR for it
- Upload the latter to your Apple Developer account and associate it with your mobile app
- In the process, your CSR is signed and you get to download the certificate
- Connect to the APN server using the key + certificate, send your notifications
Note that this is a separate key/certificate just for push notifications. It is distinct from the code signing key, and not used anywhere else. And, TTBOMK, the mobile phones never see that key, they verify that push notifications are genuine based on the fact that they receive them via a secure channel from the Apple HQ.
Here is my alternative, simpler idea: create a keypair and upload the public half to Apple. You can then send messages by authenticating with the private key.
So, why does Apple sign my key? What do I actually use the certificate for, while connecting? Is that signing dance done because SSL supports client certs but does not support bare private keys?
I'm not a cryptography expert, so please correct any wrong assumptions I've made!