How do you suggest they do that? Any enterprise certificate they use to sign the .ipa would be revoked within hours, probably minutes. Telling users to sign it

How do you suggest they do that? Any enterprise certificate they use to sign the .ipa would be revoked within hours, probably minutes. Telling users to sign it themselves (and re-sign it every 7 days) just isn't feasible. The only alternative would be not to have an iOS app, but that would also be a significant blow to their business. I can't, in good conscience, blame them for complying here.