Original text:
and the validation key material off the device.  Sometimes this is procedure is referred to as personalization or customization.  One way to provision key material is to first generate it external to the device and then copy the key onto the device.  In this case, confidentiality protection of the generator, as well as for the path needs to take care to protect corresponding key material with measures appropriate for its value. <del> Confidentiality protection can be realized via physical provisioning facility security involving no encryption at all.  For low-security use cases, this might be simply locking doors and limiting personnel that can enter the facility.  For high-security use cases, this might involve a special area of the facility accessible only to select security-trained personnel. Typically, cryptography is used to enable confidentiality protection. This can result in recursive problems, as the key material used to </del>  provision attestation keys must again somehow have been provisioned securely beforehand (requiring an additional level of protection, and so on). <del> In general, a combination of some physical security measures and some cryptographic measures is used to establish confidentiality protection. Another way to provision key material is to generate it on the device and export the validation key.  If public-key cryptography is being used, then only integrity is necessary.  Confidentiality of public keys is not necessary. In all cases, attestation key provisioning must ensure that only attestation key material that is generated by a valid Endorser is established in Attesters.  For many use cases, this will involve physical security at the facility, to prevent unauthorized devices from being manufactured that may be counterfeit or incorrectly configured. </del>  12.2.

Reviewer comments:
and
A few words on the “why that is the case” are needed here.
Both examples basically seem to be the same here?

Revised text:
and the validation key material off the device.  Sometimes this is procedure is referred to as personalization or customization. <ins> 12.1.2.1. </ins> One way to provision key material is to first generate it external to the device and then copy the key onto the device.  In this case, confidentiality protection of the generator, as well as for the path needs to take care to protect corresponding key material with measures appropriate for its value.  <ins> The degree of protection afforded to this key material can vary by device, based upon considerations as to a cost/benefit evaluation of the intended function of the device.  The confidentiality protection is fundamentally based upon some amount of physical protection: while encryption is often used to provide confidentiality when a key is conveyed across a factory, where the attestation key is created or applied, it must be available in an unencrypted form.  The physical protection can therefore vary from situations where the key is unencrypted only within carefully controlled secure enclaves within silicon, to situations where an entire facility is considered secure, by the simple means of locked doors and limited access. The cryptography that is used to enable confidentiality protection of the attestation key comes with its own requirements to be secured. This results in recursive problems, as the key material used to </ins> provision attestation keys must again somehow have been provisioned securely beforehand (requiring an additional level of protection, and so on).  <ins> So, this is why, in general, a combination of some physical security measures and some cryptographic measures is used to establish confidentiality protection. 12.1.2.2. When key material is generated within a device and the secret part of it never leaves the device, then the problem may lessen.  For public- key cryptography, it is, by definition, not necessary to maintain confidentiality of the public key: however integrity of the chain of custody of the public key is necessary in order to avoid attacks where an attacker is able get a key they control endorsed. To summarize: attestation key provisioning must ensure that only valid attestation key material is established in Attesters. </ins> 12.2.