@MrMelon in your application, src/main.c, you can create the another function like vModeKeyProvisioning, amazon-freertos/aws_dev_mode_key_provisioning.c at master · aws/amazon-freertos · GitHub
and change the keys here
xParams.pucJITPCertificate = ( uint8_t * ) keyJITR_DEVICE_CERTIFICATE_AUTHORITY_PEM;
xParams.pucClientPrivateKey = ( uint8_t * ) keyCLIENT_PRIVATE_KEY_PEM;
xParams.pucClientCertificate = ( uint8_t * ) keyCLIENT_CERTIFICATE_PEM;
when your application restart your keys, private and certificate will get, so, for send the certificates and private keys you will use Custom GATT Service, bluetooth
https://docs.aws.amazon.com/freertos/latest/userguide/ble-demo.html
it’s work too, @lundinc what you think ?