The correct answer here is an attestation server and an 802.1AR device certificate; this should be used to attest to a remote server returned via DHCP or at a w

The correct answer here is an attestation server and an 802.1AR device certificate; this should be used to attest to a remote server returned via DHCP or at a well known address (this sounds evil but a well known address and specific VLAN is the most widely deployed untrusted environment solution that actually works) which uses a long lived certificate for which the fingerprint is TOFU’d by the device. The device can use this attestation and mutual challenge to obtain a certificate (if it needs one) from an authority that other entities trust (which is necessarily not the 802.1AR CA).