/usr/bin/rpi-otp-private-key

Illegal option --
Unknown argument "?"
   rpi-otp-private-key [-cfwy] <key>

   No args - reads the current device unique private key from OTP.
   *These values are NOT visible via 'vcgencmd otp_dump'*

   -b Output the key in binary format.
   -c Reads key and exits with 1 if it is all zeros i.e. not set.
   -f Force write (if OTP is non-zero).
      The vcmailbox API checks that the new key is equal to the bitwise OR of the current OTP and the new key.
      N.B. OTP bits can never change from 1 to 0.
   -w Writes the new key to OTP memory.
   -y Skip the confirmation prompt when writing to OTP.
   -l Specify key length in words. Defaults to 8 words (32 bytes). Pi 5 supports up to 16 words (64 bytes).
   -o word Offset into the keystore to use, e.g. 0-7 for Pi 4, 0-15 for Pi 5. Defaults to zero.

   <key> is usually a 64 digit hex number (256 bit)

   Key generation:
   The Raspberry Pi firmware cryptography services requires that the device unique private key is
   a valid ECDSA with P-256 curve key. Due to limited OTP space only the raw private key component (d)
   is stored in OTP.

   Example key generation and provisioning:

   # Generate the new private-key - remember to save this to a secure, off-device location!
   openssl ecparam -name prime256v1 -genkey -noout -out private_key.pem

   # Extract raw the private key component
   openssl ec -in private_key.pem -text -noout | awk '/priv:/{flag=1; next} /pub:/{flag=0} flag' | tr -d ' \n:' | head -n1 > d.hex

   # Write the key to OTP
   rpi-otp-private-key -w $(cat d.hex)

   IMPORTANT: Raspberry Pi 5 and earlier revisions do not have a hardware secure key store
   so the raw OTP values are potentially readable by processes with root-privileges.

   In newer firmware releases, the mailbox APIs used by this script to read the OTP can
   be disabled by setting lock_device_private_key=1 in config.txt.
   On Pi4 or newer, if secure-boot is enabled, then this parameter cannot be
   tampered with because config.txt is stored within the signed boot.img.

   WARNING: Changes to OTP memory are permanent and cannot be undone.