Keys stay in the right place
The gateway needs a device public key. Device private keys belong on the device or in a securely handled imported profile. The control plane’s enrollment forms accept public keys, not private keys.
A handshake is one check
A recent handshake shows that the configured peers exchanged protocol traffic. Internet egress, DNS, routing and failure behavior need their own verification.