Now that's interesting. Normally, the entire point of having a SIM in the first place is to have a secure storage element for the crypto keys authenticating th

Now that's interesting. Normally, the entire point of having a SIM in the first place is to have a secure storage element for the crypto keys authenticating the subscriber to the network... so similar to a TPM, it doesn't make sense for anyone to be able to extract the private key material, while it does make sense to be able to import new key material while at the same time only allowing authorized parties to do so - hence the entire dance with eSIM provisioning and multiple layers of cryptography involved. But what's described in the article, at least to me, is that the source eSIM only creates some sort of token that a backend in the carrier then uses to provision a new set of keys for the destination device - so there will at least be some sort of record of such a change, and hopefully a way to prevent eSIM transfers... because otherwise this will be a pretty nasty attack vector, all you'd need to take over someone's phone number is to get their phone unlocked in your hands.