Per-App VPN for a third-party app: possible? How?
You can find the DesignatedRequirement and SigningIdentifier like this:

Start by installing the app on a device. On your Mac make sure you have the app downloaded in iTunes as well. In the folder "~/Music/Itunes/Mobile Applications/" you'll now find an .ipa file for you app.

Assuming that the app you want to target is "SomeApp" then copy SomeApp.ipa from that folder to a temporary folder. Rename the file and change the file extension from .ipa to .zip. Double-click to unzip the file. When unzipped you'll find that you have a folder named "Payload" in which a "SomeApp.app" folder exists.

Open a Terminal window and cd to the temporary folder. Run the following command:

codesign -d -r- "Payload/SomeApp.app"


This command will output the designated requirement ("anchor apple generic...").

Then run the following command:

codesign --display --verbose=1 "Payload/SomeApp.app"


This command will output a line starting with "Identifier=". The rest of the line is the SigningIdentifier.

Note that you mention the "App to Per App VPN" section of the linked manual - this specific payload is only supported on macOS. On iOS you do the same thing by sending the Settings command with an ApplicationAttributes entry over the MDM protocol.