For Facebook things, you can go through a session proxy instead of using the private key. I'll imagine storing a private key on the app (on the iPhone) is not desirable anyhow. The public key is, obviously, public.