nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq47p9fsw66pz8dmmv330a03uc0n3kne5aeq636ru3pecz77y2jp3qvhldm2 (nprofile…ldm2) Wait there were DESFire variants that could to asymmetric crypto?
Signing the UID together with some challenge would be totally fine for many applications tbh.
But yeah, I am very aware of the chicken-and-egg problem but somehow you need to break out of that cycle.