If Safari has a system back button to take me back to the app, it knows enough to include the “originating app” for the profile. Similarly it could create an as

If Safari has a system back button to take me back to the app, it knows enough to include the “originating app” for the profile. Similarly it could create an association between the domain the profile is hosted on and the app. Finally, Apple could indeed change how profile installation works such that profiles need to be signed and associated with either an Enterprise account or a per-app developer account, to make deleting such apps-with-profiles in future more robust. Lastly, like privacy warnings, Apple could say that Certificate Owner has installed a root certificate to monitor all communications and let you opt out. That would be ideal, to deprecate existing methods and even more explicitly support app-based root certificates in their privacy warning flows.