Unfortunately, they're not even good at it. Setting up a custom CI chain today as a brand-new member of the Apple Developer program, I found out that they have at least 9 different certificates to generate with no explanation which one you need on the page, and after I had generated one, downloaded it, and imported it into the keychain, the certificate was invalid. I additionally had to go to some cryptic looking page[1] and manually download the "right" in intermediary certificates.

[1] https://www.apple.com/certificateauthority/