Device manufacturers use “platform certificates” to verify an app’s authenticity, making them particularly dangerous in the wrong hands.