Let's not forget the time-proven insecurity of your average IoT device, coupled to generally terrible security practices in (any given organisation)... I'd rath

Let's not forget the time-proven insecurity of your average IoT device, coupled to generally terrible security practices in (any given organisation)... I'd rather deal with physical keys. Whoever is in control of your API keys is opaque for the tenants. If you think your physical keys are compromised you can just replace the cylinder.