Welcome to the world of mobile phones. You're new here, aren't you? :)

This has been a problem since the beginning of time. Applications need to be signed with the manufacturer or phone provider's certificate in order to get access to integral functionality (camera, phone book, filesystem etc.). Then the phone provider decides to get greedy (*cough*T-Mobile*cough*) and strips manufacturer certs off the phones so that developers need to pay twice to play. Things get greedier and greedier as you go up the chain.

So yeah, this is not new; the whole certificate industry is messed up.

Companies like Adobe, Apple (in this case), Microsoft, Thawte, Verisign etc. have all positioned themselves so that a) they get paid under the false premise of security, and b) they retain the role of gatekeeper. Look at Microsoft: back in the late 90s they owned 5% of VeriSign's equity. Should it come as a surprise that VeriSign is the only acceptable certificate authority for signing device drivers under Windows?

Code signing for developer identification is a good idea (I like Thawte's Web of Trust concept), but the idea of needing to pay dozens of profiteering gatekeepers for my iPhone app, J2ME app, Symbian app and SSL-enabled web app is ridiculous. Only problem is, the issue is much bigger than Apple-targeted development.