They had a cloud of Apple devices that they already used for their relay service, and could easily generate keys using several devices. From my understanding, the best vector for Apple was to actually block their "BPN", the push server.