[lrem]

Well, they don't need to listen to everyone that knocks. I'm sure we would be delighted when devices would only talk to clients with valid certificates from the vendor, right?

Edit: disclaimer: I work for Google, but my only contact with the home ecosystem is having a Chromecast.

[TeMPOraL]

Would we? The next thing that would happen is those certificates would end up inside secure chips, and suddenly the only way to talk to an IoT device would be through an official vendor's app, over an official vendor's bridge. No thank you. Turning physical products into services is not what I want.