I am making a web application that distributes data encrypted with the public keys of its clients. At this moment this is working for dedicated devices which I distribute myself. Before they are shipped, I flash the public/private keypair into the devices firmware.
However since this is 2017, I also wanted to make an android application to make any android device act like one of the devices I sell, since this is easier for customers. The only bottleneck I am experiencing is the distribution of the keys.
I can generate a public/private keypair at the Android device upon first start of the app, and securely store them in the internal storage, but I need to find a way to send the generated public key of the Android device to my server, so my server can encrypt the data with it.
The reason why I cannot simply send the public key as a HTTP request to my server is, that I do not want someone with a computer to be able to generate a public/private keypair and send that to my server to also be able to receive data as. It's very easy to decompile Android applications or use wireshark to find out the url used to register new keys.
If I were to use this way, how would I verify at my servers end that the request is originating from a legitimate Android device?