You can sign apps without Apple being "in the loop" and distribute them via the web with an enterprise cert. As far as pushing out updates I think you have to b

You can sign apps without Apple being "in the loop" and distribute them via the web with an enterprise cert. As far as pushing out updates I think you have to build your own system for that. My company uses enterprise certs and our app will notify the user when there is an update, redirect them to a web portal where they click a link, are prompted to install the app, and then the app is installed.