I like @chrysn’s proposal. It should provide a generalized secure access to a device (assuming CoAPS/OSCORE and given there is also some authentication happening at some point, but I guess this could be done with some additional link) while also fitting well into the constraint use-case.
On the RIOT-side, there are several open threads that IMHO need to be addressed first: