The EU Cyber Resilience Act expects three engineering practices from connected devices: secure boot, verifiable firmware updates and a cryptographic device identity. Why they are one key-management problem, and three questions to test your own product.