Securing communication [Authenticity, Privacy & Integrity] with mobile app?
Use client authentication with SSL or just layer your own client authentication (username/password, token, etc) on top of server-authentication SSL. 
(Edit: Moving the comment here, since it won't fit as a comment)
To elaborate a bit, any authentication info needs to be stored or entered in the app. If you have people enter the password each time, you don't need to save it, but that's clearly inconvenient. You can encrypt it with a device-specific key, so it's not visible on rooted devices. With a private key, you need to either protect it with a user entered password (see above) or have it protected by the system. That is only available since Android 4.0 (ICS) with the public API to the system keystore, the KeyChain class. In this case, the user needs to unlock (using pattern/password or PIN) the phone to access the keystore.
An Android/Iphone app will be accessing application data from the server. 
[Django-Python]
How can I secure the communication with the mobile app ?
Expectation : Secure enough for sensitive information like passwords, there shall be no direct way of decryption except brute-forcing.
My requirements :

Authentication [Only the app is authorized]
Integrity [Messages should not be modified in between]
Privacy [Communication should not be readable if sniffed]

My effort:

SSL authenticates only the Server, not the client.
I can-not use a symmetric encryption [Provides only Privacy]
Digital signature is not possible [Lacks Privacy]
PGP full-fills all 3 requirements.

Problem :

PGP requires to store keys on client app.
There seems to be no assuring way of securing keys on client app.
If the key is out, then PGP or Symmetric encryption are equally vulnerable.
Reverse-Engineering PGP keys or symmetic keys is equally hard.
In that case PGP is a non-sense burden on the mobile processor.
OAuth is again useless, since it also have a client key.

So, how can/should I move forward on this ?
How does the industry deals with this ?
Should I implement casual approach :

Use simple SSL and cross my fingers ?, since authentication is not possible if the keys are stolen? (Only server authentication is possible with this)

Update:
Conclusion was to use AES, since if I can keep the key secure then I am as good as SSL.
Plus I can keep changing the key over-time for better security.
Contribute if you think there is a better way, do read the entire post before posting.