This isn't the case for platforms that don't have a compulsory 'app store' model. I can write an app for Android or Windows Mobile (and probably many other platforms) and distribute it any way I see fit.
If yes, who controls access to the capability of issuing/revoking certificates?