[progval]

Then they could have their server tunnel ACME challenges to the device, so the private key never leaves the device, but can still be signed.