[Zarel]

> Or ship the device with the signed cert.

Certs expire sometimes. And the device doesn't necessarily have an internet connection. What then?