There is a PayloadUUID key for com.apple.webcontent-filter.

I don't know which certificate to use for encryption. Does the APP client need to install a specific private key?