Design enrolled-device identity and separate remote-policy signing keys

[ShalomMaman]

Parent epic: #41

Goal

Define a production-safe cryptographic identity model for enrolled devices and remote policy without reusing APK, update-metadata or local administrator secrets.

Dependencies: #25 and #28.

Required key separation

Use distinct keys and access boundaries for:

• production APK signing;
• signed software-update metadata;
• remote desired-policy signing;
• each enrolled device's authentication identity;
• test, staging and production environments.

A device identity should be generated or securely installed during provisioning, stored in Android Keystore, and hardware-backed when supported and verified. The design must state how the service binds that identity to the correct account owner, enrollment and physical device without relying on a reusable shared secret.

Scope

• Enrollment proof and device registration.
• Mutual authentication or an equivalent independently authenticated reporting/policy channel.
• Device-key attestation policy where available, including a safe fallback where it is not.
• Policy-signing key storage, access control, backup, rotation, overlap and emergency revocation.
• Device replacement, reprovisioning, lost-device and cloned-client handling.
• Environment separation and prevention of production keys entering ordinary builds or tests.
• Observable key identifiers without exposing private material.

Acceptance criteria

• A key-purpose and trust-boundary document shows that no signing/authentication key is reused across roles.
• Every enrolled device has an independently revocable identity bound to its enrollment record.
• Private keys, passwords and recovery material cannot enter the repository, public Issues, artifacts or logs.
• Rotation supports bounded overlap without accepting indefinitely old keys or policies.
• Compromise procedures distinguish user account, device key, policy-signing key, update key and APK signer incidents.
• Provisioning and production builds fail closed on missing, wrong-environment or unapproved identity configuration.
• Tests cover key mismatch, revoked device, rotated signer, cloned identity and stale key identifiers.

Non-goals

• Using the local administrator PIN or recovery code as a device credential.
• Reusing the APK signer to authorize policy changes.

Hebrew summary

לכל מכשיר ולכל מטרת חתימה צריך להיות מפתח נפרד. מפתח האפליקציה, מפתח העדכונים, מפתח המדיניות וזהות המכשיר אינם ניתנים להחלפה או לשיתוף, ויש להגדיר גיבוי, סבב וביטול בטוחים.