How about using RADIUS auth with unique credentials for each device? You still have to revoke old credentials, but this is much more reasonable than rotating th

How about using RADIUS auth with unique credentials for each device? You still have to revoke old credentials, but this is much more reasonable than rotating the shared key on every device every time you throw away a bulb.