They require push notifications to be signed with your certificate. You must maintain the infrastructure to do this yourself because you can't share the certificate with third parties (obviously) and downtime will mean no push notification delivery.

I have no idea if that's in the guidelines but that's how it works.