What's to prevent a man-in-the-middle in the factory? Say the device is provisioned in the factory and generates its public-private keypair. The private key ne

What's to prevent a man-in-the-middle in the factory? Say the device is provisioned in the factory and generates its public-private keypair. The private key never leaves the secure enclave. The public key is intercepted in the factory and replaced by the attacker's public key, which then makes it to Google's servers. To forestall "but that would require a lot of resources" argument, assume the man-in-the-middle is the Chinese State and the attacker moves their man-in-the-middle operation to China's Great Firewall. As long as the device remains in China, all traffic can be intercepted at the Great Firewall, where certificate requests are man-in-the-middled in bulk. tl;dr: This new scheme shifts the burden of trust to the factory and Google's servers. I'm sure there are other ways to exploit that channel.