> In the article, you have the key in an env variable. Only during the moment of provisioning. > In particular, if someone prebuilds the keys for you, he/she

> In the article, you have the key in an env variable. Only during the moment of provisioning. > In particular, if someone prebuilds the keys for you, he/she has you key. You have a similar weakness. If someone prebuilds the keys, you don't know if they are loading a fixed key. You also have the problem of not knowing if the attestation cert is actually trustworthy, or where else the key for that cert might live.