They will be forced to eventually. But from a technical/security standpoint it’s not at all hard for them to do. They use PKI for all apps and from the security standpoint, it’s a matter of adding another certificate to the trust chain. Obviously there are many UI considerations, but I’m just saying this doesn’t require some crazy core/kernel engineering revamp of iOS.