It might make sense if a unique private key was generated each time the application was downloaded. For example, a user wishing to use the Azure web services e

It might make sense if a unique private key was generated each time the application was downloaded. For example, a user wishing to use the Azure web services either supplies their own cert/public key to Azure, OR requests Azure to generate a unique cert/key, and supplies the private key to you. Now, obviously, someone using Azure APIs doesn't install this key into your root store. And that's the second "WTF?" - why install this as a Trusted Root cert, when your application could just hold it locally, and reference it? (The first WTF being distributing a common private key - rendering the point of encryption useless.)