Devices should not store passwords (or password hashes), and so should never need updating. Instead, a unique TLS client certificate should be issued to the de

Devices should not store passwords (or password hashes), and so should never need updating. Instead, a unique TLS client certificate should be issued to the device during provisioning. If a device gets compromised, revoke its cert without affecting all the other (uncompromised) devices belonging to the user. Getting through that provisioning process without confusing or annoying the user is the hard part.