Apple doesn't need to publish it. All one needs to do is collect a bunch of OSX apps (app store, creative cloud, web downloads of .dmg, whatever) and pull out the certificate serial numbers. This mapping is effectively public data, if you bother to go about collecting it.

Then, anyone monitoring your connection knows which apps you launch, when, and where you do it. Additionally, Akamai (and their ISPs) get your complete (IP geolocation) tracklog, and knows when you're at home, when you're traveling, and which apps you use in those places.

I wrote about the consequences of this just an hour ago:

https://news.ycombinator.com/item?id=25078034

Interesting thing is, Apple will deny apps from the App Store that make unencrypted connections (via App Transport Security), but their own, firewall-exempt, vpn-bypassing system processes can do it just fine. :D