On-board STSAFE secure element with ST-issued ECC P-384 certificate provisioned at point of chip manufacture.
Sessions are TLS-encrypted to the Notehub: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Kind of wonderfully, all traffic flows from the carrier over a VLAN to the AWS/Azure Notehub instances, so your devices aren't even visible to attackers on the internet.
And if you don't want your data in the clear on the Notehub, there are options for you to place your server's public key in fleet environment variables, and the data will be end-to-end encrypted between device and your service.
Interestingly, setting aside whatever else you can say about Lotus Notes, Ray's work was some of the earliest to prioritize what we now recognize as good infosec practices in client/server computing.
He's got plenty of street cred in this area, enough to earn the benefit of the doubt.
Only if your attackers pay for access - just kidding, but in this approach the board isn't connected all the time I don't think, only when it sends a message.
sounds like a security nightmare