Recently we had a problem with updating our mobile apps using Citrix Xenmobile 9.0 MDM + MAM. The problem was that during updating process the icon of updated app become blank and when you click on it, it shows this message "Untrusted Enterprise Developer".
We tried to go to profiles and click the button Trust there, but it was not our case (there wasn't any button), maybe because in case you use MDM trusted relationsip is setted automatically.
After trying all rolling patches from 2 to 4 we didn't succeed.
Then I recalled that I did install this patch http://support.citrix.com/article/CTX204322 when we experienced problems with installing apps during update from ios8 to ios9. I applied it and it didn't work anyway, but unfortunately I leaved it (didn't roll back). I deleted this patch (it's enough to delete this file a_patch_900_9924.jar from \XenMobile Device Manager\tomcat\webapps\[instance_name]\WEB-INF\lib and restart XenMobile Service) and then it's worked.
There is also the the case that rolling back from MDM patch 4.0 to 3.0 is helped.
http://discussions.citrix.com/topic/380606-unstrusted-enterprise-developer-updating-worx-apps/
