You create a (self-signed) CA certificate, put its certificate as the client ca in your web server.
Then you can create certificates using this CA that you distribute to your devices, only devices that have a certificate signed by your CA are allowed to connect.
The problem with that would be that it would make switching to another linux ditribution very, very easy. They would have 99.99% compatibility so a lot of people would switch to another distro if they add stuff like recall.
They would also be opening the can of worms that is massive software support for linux (which is arguably already opening.)
But…an onion address doesn’t need a cert?