OS restore from backup can leave out the config profile

[gandg]

A configuration profile certificate may remain in the trust chain, even when the configuration profile is no longer on the device. Since the Passcode Check API checks only the trust of the certificate, it may report that a passcode is set when it is not.

This appears to happen when an iOS device is restored from backup. The certificate remains in the trust chain, while the configuration profile is no longer on the device.

When this occurs, installing, then removing, the configuration profile appears to remove the certificate from the trust chain.