I'd compare it to non-encrypted and signed pagestate in ASP.net or JSP, it works but it's completely untrustworthy. IMO this shouldn't be hard for apple to solv

I'd compare it to non-encrypted and signed pagestate in ASP.net or JSP, it works but it's completely untrustworthy. IMO this shouldn't be hard for apple to solve either, they can just create a key in keychain and use that to sign the file using the existing and standardized XML signing algorithm. That way any change to the file, even the XML will cause it to get discarded.