Credential Management

Status: DRAFT

Credentials in scope:

• NATS private seed / key material
• NATS JWT
• VPN private key/certificate
• OTA trust public key
• local maintenance keys

Requirements

• unique credentials per device
• no fleet-wide private secret
• least-privilege filesystem permissions
• no secrets in logs
• no secrets in compliance evidence
• revocation capability
• rotation procedure
• secure provisioning
• documented recovery/replacement process

TODO: document current file locations and permissions without committing secrets.