This patch looks a bit scary. What is it doing?

In short, this disables signing using "Certificate, Key, and Trust Services API" and makes it use CSSM API instead. If you look below, this branch, that I removed, is hidden behind a version check:

if (base::mac::IsAtLeastOS10_12()) {
  return /* bla using SecKey */;
}

return /* bla using CSSM */;

So I only drop an optional execution path.

There is a nice overview of the API's in http://www.arp.com/medias/13902065.pdf . From their explanation, I understood that CSDA (and CSSM) are more sophisticated API's produced by some open source standard group while "Certificate, Key, and Trust Services API" is what Apple wants us to use. They seem to allude that the latter API is just a wrapper around the former:

Where possible, you should use one of the following instead of using CDSA directly:

• The Certificate, Key, and Trust Services API for general encryption, key management, and other tasks.

I suppose, the reason why CSSM is not the preferred API in chromium is because they want to maintain it in a future proof state. My best understanding is that this patch is harmless and we can drop it once 10.12 SDK lands.

ok.

Isn't whether ARC is used a property of a codebase, rather than of an SDK version?

The comment says that at very least some of the headers in our SDK don't compile when ARC is enabled.