What security risk does storing a server-side API private key inside a mobile app represent, and why is this categorically different from storing a symmetric API key in the app?

• A.The Keychain refuses to import a third-party private key on iOS, because SecItemAdd rejects any kSecClassKey payload the Secure Enclave did not generate, and the developer therefore has no way to protect the material at rest; the practical difference from a symmetric API key is one of storage rather than impersonation, since both end up in the app bundle where all static secrets live
• B.A private key inside a mobile app can be extracted and used to impersonate the server - anyone who extracts the private key could set up a fake backend that clients authenticate as legitimate. A symmetric API key only allows the client to authenticate to the server, not impersonate it. No private key should ever be distributed in a mobile app; keys should be generated on the server and the corresponding public key placed in the app for pinning