I'll be honest, I've never set up the thing I mentioned, but it sounds vastly less error-prone than writing some certificate update support (likely written in C

I'll be honest, I've never set up the thing I mentioned, but it sounds vastly less error-prone than writing some certificate update support (likely written in C/C++) that writes the certificate bytes directly to the devices. Initial can-of-worm questions are "who's allowed to update the cert?", "how does the device authenticate the person updating it?", "what's the failure mode if an update goes wrong?", "how long shall we test the new cert-writing-module?", "will the customer even bother after the initial certs expire we install for them and instead just tell their users to flip the Chrome flag?", "how do we also update TLS and crypto libraries to support future certs or standards?"