[Iot-onboarding] So... looking where we are

[Eliot Lear <[e-mail]>]

Hi everyone,

Thanks to a few people for contributing to the GitHub repo we are well on our way.  Dave Thaler in particular has pointed out that we might be asking the wrong questions in some cases.  I wonder if we could have that discussion.  Here are the questions, as they are listed there:

How does device introduce itself to the infrastructure or peer?
What, if any, proof of possession mechanism is there?
Is access to other IP-based devices required in order to fully onboard the device?
What form of credential is returned?
Is full Internet access required for onboarding?
Who becomes the root of trust at the end of onboarding (if any)
Could/Is the resulting credential be used for application identity?
What happens if the box gets reset?
How can transfer of ownership occur?
How can transfer to a different cloud service (if applicable) occur?
What sort of manufacturing requirements are there?
What sort of crypto requirements are there?
Reference link
The one in red is the one that Dave called out as not well-formed.

Eliot