Guided onboarding: pick the authorizing token, hand the bootstrap payload to the device (USB, QR, or EMCON animated QR), then watch it come up from provisional to trusted.