anchor.diff:  | `uptane_private_key_path` |         | Path to the device's private key.
   | `uptane_public_key_path`  |         | Path to the device's public key.
   | `tls_cacert_path`         |         | Path to the TLS root CA certificate.
  -| `tls_pkey_id`             |         | Path to the TLS private key.
  -| `tls_clientcert_id`       |         | Path to the TLS client certificate.
  +| `tls_pkey_path`           |         | Path to the TLS private key.
  +| `tls_clientcert_path`     |         | Path to the TLS client certificate.
   |==========================================================================================
   
   == `telemetry`
  
positive.code: | `uptane_key_id`      |         | Key ID of the Uptane key in the HSM.
  | `tls_cacert_id`      |         | Key ID of the TLS root CA certificate for authenticating the server.
  | `tls_pkey_id`        |         | Key ID of the client's TLS private key.
  | `tls_client_cert_id` |         | Key ID of the client's TLS certificate.
  |==========================================================================================
  
  == `tls`
  
negative.code: Options for how the device is provisioned with the backend.
  
  [options="header"]
  |==========================================================================================
  | Name                        | Default   | Description
  | `server`                    |           | Server provisioning URL. If empty, set to `tls.server`.
  | `primary_ecu_hardware_id`   |           | The hardware ID of the primary ECU (e.g., `"raspberry-pi"`). If left empty, the hostname of the device will be used.
  | `provision_path`            |           | Path to an archive containing provisioning data. See link:credentials.adoc[] for the specification of the contents of this file.
  | `p12_password`              |           | Password for PKCS#12 encryption.
  | `expiry_days`               | `"36000"` | Provided in the `ttl` field of the device provisioning request sent to the server.
  | `device_id`                 |           | Device ID of the primary ECU. If left empty, a random name will be generated.
  | `primary_ecu_serial`        |           | Serial number of the primary ECU. If left empty, a random serial will be generated.
  | `ecu_registration_endpoint` |           | Ecu provisioning URL. If empty, set to `uptane.director_server` with `/ecus` appended.
  |==========================================================================================
  
  If you intend to provision with a server by using https://github.com/advancedtelematic/meta-updater[meta-updater], you will probably want to set `provision.provision_path = "/var/sota/sota_provisioning_credentials.zip"`.
  
  