You certificates uniquely identify your app in the store. If someone gets a copy of them (along with the password) they can replace your app with an app of their own. This is especially a problem for successful games and financial apps, where there is a tempation to impersonate an app for personal gain. With this process your data is more secure, because we do not keep the password in your account, thus if someone hacked your account in the XDK server they would only have half of the information necessary to take over your app in the store.
