Not if the server key is just hardcoded into the app, which can be appropriate in some cases; of course, that raises the question of how to secure the app downl

Not if the server key is just hardcoded into the app, which can be appropriate in some cases; of course, that raises the question of how to secure the app download, but that's usually done over a separate protocol anyway.