Either Apple would generate it server-side, or the first device to "sign up" would generate it.

Remember, I'm only explaining a hypothetical method by which the Apple system could work, consistent with Apple's statements and behavior I've observed from my iPhones, iPads, and Macs. It's not an explanation of a strictly secure system.