I don't know which certificate to use for encryption. Does the APP client need to install a specific private key?

There is a PayloadUUID key for com.apple.webcontent-filter.