How do code signing and provisioning work?
Code signing
A signature proves who built the binary and that it has not been altered. Mechanics: Xcode hashes the code and resources and signs the hash with the developer's private key; the certificate contains the matching public key and is itself signed by Apple (a chain of trust up to the Apple Root CA). On install and launch the system verifies the chain and the hashes; on mismatch the app will not launch. Entitlements — rights (push, iCloud, App Groups, Keychain sharing, HealthKit) — are embedded in the signature; they must match what the profile allows, otherwise install fails or the API call is refused.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep