That was it. Residency page says EU, the US plant’s org is US. Changed the host to the one on our Connection details card and all 23 sensors were online within ten minutes. Lewis, you were right as well, the firmware had their server certificate pinned. I switched it to the normal CA bundle, otherwise the handshake would have been the next failure. Host now comes from a config partition. Thanks all.
Ground loops are my cardio.