trusted network-layer onboarding

A network-layer onboarding process that: provides each device with unique network credentials, provides the device and the network an opportunity to mutually authenticate, is performed over an encrypted channel (to protect network credential confidentiality), does not provide anyone with access to the network credentials, and can be performed repeatedly throughout the device lifecycle (to enable network credentials to be replaced).