According to [1], the whole dance with the OIC and OIK happens > When macOS is first installed in the factory, or when a tethered erase-install is performed S

According to [1], the whole dance with the OIC and OIK happens > When macOS is first installed in the factory, or when a tethered erase-install is performed So when you're setting up for the first time after the factory install, it already has the OIC. I think. [1] https://support.apple.com/guide/security/localpolicy-signing-key-creation-management-sec1f90fbad1/1/web/1 https://support.apple.com/guide/security/localpolicy-signing...