CLAIM_DEVICE_CSR_KEYS: readonly ["csr", "CSR", "csr_pem"] = ...

Keys a device may use for its CSR in the claim payload, checked in order.