anchor.diff:  
   ## Steps
   
  +1. Generate a root CA private key and self-signed certificate.
  +1. Upload the root CA certificate to the server.
  +1. In meta-updater, set `SOTA_CLIENT_PROV = "aktualizr-implicit-prov"`. Currently, you will also need to set `SOTA_PACKED_CREDENTIALS` to a provisioning credentials zip file.
  +1. Build a standard image using bitbake.
  +1. Boot the image.
  +1. Sign the client device certificate with the root private key and install it on the client device.
  +1. The server shall provide its own internal root CA certificate to client device. Currently, `implicit_writer` is used to read the server's root CA from the `SOTA_PACKED_CREDENTIALS` and install it on the device during bitbake.
  +1. The server shall authenticate the client device by verifying that the client's certificate was signed by the your root CA private key. (The server uses the root CA certificate that it was given in step 2 to do so.)
  +1. The client device authenticates the server by verifying that the server's certificate was signed by the server's internal root CA private key. (The client device uses the server's internal root CA certificate that it was given in step 7 to do so.)
  +
  +## Simulated implicit provisioning with `cert_provider`
  +
  +Implicit provisioning can be simulated with `cert_provider` without need for the user to create a root CA. `cert_provider` uses the existing autoprovisioning mechanisms to pre-install a certificate and key on the device.
  +
   1. In meta-updater, set `SOTA_CLIENT_PROV = "aktualizr-implicit-prov"`. Currently, you will also need to set `SOTA_PACKED_CREDENTIALS` to provisioning credentials zip file.
   1. Build a standard image using bitbake.
   1. Boot the image.
  
positive.code: |===================
  | Configuration option | Where it will come from
  | Server URL | Written into `sota.toml` during bitbake via `implicit_writer`
  | Root CA cert | Installed to `/usr/lib/sota/root.crt` during bitbake via `implicit_writer`
  | TLS key/cert | Pre-installed or manually installed, e.g. with `cert_provider`
  | Device ID | Read from Common Name field of TLS cert
  | Uptane public/private key | Automatically generated by Aktualizr
  | Uptane primary serial number | Automatically generated by Aktualizr
  
negative.code: 
  ## Background
  
  In automatic provisioning, bootstrap credentials are downloaded and installed on devices to initiate the provisioning process. In implicit provisioning, devices shall be pre-loaded with the requisite provisioning credentials signed by a root CA certificate which shall be uploaded to the server. The server will thus be able to authenticate a client device by verifying that the client's certificate was signed by the uploaded root CA.
  
  ## Configuration
  
  