To be granted an enterprise or standard developer signing certificate, you must agree to a contract that stipulates the valid uses of that certificate.

I think it's reasonable to call blatant disregard for contractual obligations "illegitimate".