1. A method of signing code, the method performed at code signing server, the method comprising: receiving, at the code signing server, a code signing request to sign a software application or hash thereof using a private key of a key pair associated with a sensitive application programming interface provided on a mobile device, the software application programmed to access the sensitive application programming interface when the software application is run on the mobile device, wherein a public key of the key pair is attached to or embedded in the sensitive application programming interface to control access to the sensitive application programming interface; digitally signing the software application or hash thereof, wherein a digital signature is generated using the private key; and outputting the digital signature in response to the code signing request.