I had this idea at some point few years ago of auto-provisioning WPA2-EAP credentials for guest users, with network admin confirmation. Too bad it didn't really

I had this idea at some point few years ago of auto-provisioning WPA2-EAP credentials for guest users, with network admin confirmation. Too bad it didn't really progress much beyond few flowcharts and weekend on getting confused with RADIUS. But I think the central concept is still workable, and aligns pretty well with what you are proposing here. Of course in IoT context there is the little problem that all the crappy devices are unlikely to support EAP, but that is another story.