You can in fact get a certificate for 99 per year and use that to generate entitlements that Apple will happily sign CSRs for. It's how we use MicroMDM.
We would love to be able to send push notification to native apple Mail app for our users but we never wrapped our head around the whole certificate thing. (And Apple was... unhelpful).
Would love to have support on this! Are you available? Let me know (nicolo.benigni@qboxmail.com)
ABE and ABM both use the same technology so it's pretty much exactly how Apple intends it to be used. There used to be someone hosting a shared CA for this, but it because cumbersome to deal with third parties not loading the CRL and not using OSCP.