You should be able to rotate the certificate on the device; this is not a major technical challenge.

Local hubs solve that pretty well, aside from still needing to update the hub.