1. A method of controlling access by code to one or more application programming interfaces (APIs) of a mobile device, the method comprising: determining whether the code is signed with an authentic digital signature indicating authorization for the code to access one or more sensitive APIs of the mobile device, wherein the mobile device includes at least one sensitive API and at least one non-sensitive API, wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API, wherein the authentic digital signature is generated by a code signing authority that issues authentic digital signatures external to the mobile device; and controlling access by the code to the one or more sensitive APIs depending on whether the code is signed with the authentic digital signature.