anchor.diff:  
   ## Background
   
  -In automatic provisioning, bootstrap credentials are downloaded and installed on devices to initiate the provisioning process. In implicit provisioning, devices are to be pre-loaded with the requisite provisioning credentials.
  +In automatic provisioning, bootstrap credentials are downloaded and installed on devices to initiate the provisioning process. In implicit provisioning, devices shall be pre-loaded with the requisite provisioning credentials signed by a root CA certificate which shall be uploaded to the server. The server will thus be able to authenticate a client device by verifying that the client's certificate was signed by the uploaded root CA.
   
   ## Configuration
   
  
positive.code: 
  ## Steps
  
  1. In meta-updater, set `SOTA_CLIENT_PROV = "aktualizr-implicit-prov"`. Currently, you will also need to set `SOTA_PACKED_CREDENTIALS` to provisioning credentials zip file.
  1. Build a standard image using bitbake.
  1. Boot the image.
  
negative.code: |===================
  | Configuration option | Where it will come from
  | Server URL | Written into `sota.toml` during bitbake via `implicit_writer`
  | Root CA cert | Provided by the user; installed to `/usr/lib/sota/root.crt` during bitbake via `implicit_writer`; must also be uploaded by user to the server
  | Root CA key | Provided by user; used only for signing
  | TLS key/cert | Pre-installed or manually installed; must be signed by Root CA key
  | Device ID | Read from Common Name field of TLS cert
  | Uptane public/private key | Automatically generated by Aktualizr
  | Uptane primary serial number | Automatically generated by Aktualizr
  