You need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.