The ESP32 has a unique ID you can get through espressif API. It has 6 or 8 bytes if I remember correctly
A bit outside topic as per your remark, but you need to look at your security stance. What are you protecting against and how you secure the keys at rest for example