Just a guess but once you&#x27;ve completed the TLS negotiation the APNS server doesn&#x27;t need to re-authenticate for the lifetime of the socket connection whereas with API keys the key would need to be verified with each notification (because a new connection would be created)?