Use of IAcquireAADTokenService in Custom Visual

I am trying to implement the use of a acquiring a token through the IAcquireAADTokenService service in a custom visual, but the documentation is not perfectly clear. There are parts that read as if the use of this service is only allowed to be called by a MS certified custom visual. Other documentation seems to hint that a visual in the organizational store can be used if the policy is set to allow token retrieval is enabled. It also indicates this service should work in debug. I am unable to successfully use the service in either of the latter two scenarios with an uncertified visual.

It wouldn’t make sense to me that this service could only be used for certified visuals because it seems the whole point of obtaining the token would be to provide the token for authentication to an external service managed by the organization which would accept the token to authenticate or to retrieve an access token from an OAuth service to do the same. Accessing external Apis, though, prevents a visual from being certified.

Seems like publishing it to the org store would be good enough considering there is a policy that disables the ability to call the API.