@yanshay
The local(not dev mode)/cloud authenticated signing is using a two-tiered system with mTLS via client certs. The repo currently handles 'user' tier - safe commands, like light control (system) - but the 'device' tier - non-safe commands like temperature/fan/print control (print) - is what is necessary. Studio/Handy/etc have an embedded client cert and pkey to authenticate. The pkey is necessary to sign the 'print' commandsso the system doesn't reject with 84033543 (TLS/auth layer rejection).

client.tls_set(
  ca_certs=bbl_ca_bundle,
  certfile=client_cert,
  keyfile=client_key
)

I'm only sharing what's 'observable' for now to keep the repo within safe boundaries. I do, however, have a mass amount of API doc updates I will be sharing soon - then fixes for the implementation after.

On the structural side, some MQTT message formats differ between local/cloud modes. The python client has issues with the incrementing sequence_id/field ordering/etc. These need alignment with the device level message structure.