Yes, but with JIT, you can't really verify what the application does upfront. That is the entire point.
Capabilities are a way to control that, and the point being that only responsible proven applications get the certificate, hence how it all goes on iOS.
alt Hacker News
Capabilities are a way to control that, and the point being that only responsible proven applications get the certificate, hence how it all goes on iOS.