“Our second interesting problem, which is a much worse, “oh no”-level problem: for some reason, passes are cryptographically signed, and they have to be signed with a key known to one of Apple’s certificate authorities.”
Putting your own library barcode in Apple Wallet requires a $99 developer account. The workaround was a free pass-maker app that shipped its Apple signing key inside the bundle, password and all. Apple’s gatekeeping stopped one person with a library card and none of the developers who left the key lying around.