I am partly considering trying to reverse sharingd and AuthKit so I can fetch SFAppleIDIdentity certificates and AppleIDValidationRecord over HTTPS.

Right now I just have someone dump certificates and private keys by (without disabling amfi) inject a dylib into simulator and wait for...