If the private keys are distributed inside an approved client app then any competent hacker can decompile the binary and extract the keys. At that point the keys can be used by bots or other unauthorized apps, and there's no reliable way for the server to distinguish them.