IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers.
It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device.
Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...
IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers.
It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device.
Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...