It is relatively easy to do the negotiation in a way that nothing at the factory ever sees the resulting session secret. DH is obvious and in this case secure a

It is relatively easy to do the negotiation in a way that nothing at the factory ever sees the resulting session secret. DH is obvious and in this case secure approach, but even simply generating random key in one or other end of the secure link and sending it in plaintext for the first time will be essentially sufficient (you still have to trust the environment this happens in to large extent).