In systems with 2-part principals, it is crucial to strongly authenticate both parts of the principal, not just one part. (Otherwise, the system essentially degrades into a 1-part principal system.) This is why, for example, both Android and iOS require that every vendor (i.e. origin) cryptographically sign its code. That way, when a user chooses to install Twitter and to give Twitter powerful permissions (such as access to the device’s camera), they can be sure that they are granting such capability only to the Twitter code, and not to just any code.