According to this link in the section "In-house apps | Providing updated apps", I should be able to just distribute a new .mobileprovision file instead of forcing users to install a new version of the app:
For users who already have the app, you may want to time your next released version so that it includes the new provisioning profile. If not, you can distribute just the new .mobileprovision file so users won’t have to install the app again. The new provisioning profile will override the one that’s already in the app archive.
How is that even possible? Isn't the distribution profile necessary for compiling/singing the app? I would like the convenience of just being able to distribute a new certificate, but I'm very skeptical this can even work. Does anyone know for sure? Or am I mis-interpreting this wording? If not, how can I make this work?