If memory serves correctly, signing certificates are issued to developers and signing is done locally on the build machine. Apple cannot deny signing on a per-

If memory serves correctly, signing certificates are issued to developers and signing is done locally on the build machine. Apple cannot deny signing on a per-app basis. They could revoke a developer’s certificate perhaps, but that’s something else. They may co-sign a binary in the App Store but that seems irrelevant for other distribution channels.