There’s further discussion here https://news.ycombinator.com/item?id=25095438 Essentially: the phoning home is checking hashes of developer certificates to make sure they aren’t revoked.