I found a comment on this blog [1] by someone claiming to have reverse engineered the iMessage protocol. [2]

In his comment, he says: "OS X 10.9 (and probably also iOS 7) does certificate pinning for the push connection, I don't know about the directory lookup."

[1] http://blog.cryptographyengineering.com/2013/06/can-apple-re...

[2] https://github.com/meeee/pushproxy/blob/master/doc/apple-pus...