Really helpful, thank you. Supervisor accepted “public CA on card, secrets in encrypted NVS”. The X.509 bit saved me a week, I had already started generating a CA with openssl. Funny enough I had cloned the card for a second board last week and the data was patchy, it was exactly the takeover thing.
Timestamps in UTC or it didn't happen.