4 USD × 500 is cheap next to radio certification. Take an nRF52832 module that carries its own FCC ID and CE paperwork (Raytac MDBT42Q is the one our lab uses), follow its layout rules for the antenna keep-out, and you only need the cheaper unintentional emissions testing for the whole product. Keep your firmware as is, the chip is the same.

For Hermetry: the tags themselves never log in. You put a BLE gateway on each floor (a Pi or any box with BLE and network) that listens to the adverts and reports each tag as a child device over the gateway API:

v1/gw/telemetry
{"tag-C4A1F0": {"values": {"temp_c": 4.2, "batt_mv": 2950}},
 "tag-C4A1F7": {"values": {"temp_c": 6.8, "batt_mv": 2910}}}

Hermetry creates each child the first time it sees the name, puts it in the gateway profile’s „Profile of new children“, and children never have credentials of their own. That answers Emily: one token per gateway, three or so per building, nothing per tag. A gateway takes up to 500 children by default, and each child counts toward the plan’s device limit.

If two gateways on neighbouring floors hear the same tag, decide in the gateways which one reports it, otherwise you get it twice under two names. Details: Devices behind a gateway.