claim certificate
A credential shared by a batch, allowed only to request a device's own identity at first connection.
A claim certificate is a shared, narrowly-authorised credential embedded in a batch of devices that permits only one action: requesting a unique device certificate at first connection.
Examples
Every device in a batch ships with the same claim certificate, allowed only to request its own certificate at first connection.
A stolen claim certificate can be limited by an allow-list of serials the factory actually made.