Factors used in binding

Is there a complete list of factors that are used to compute device identity when a Zymkey is bound to a device? Or at least a list of things that are not used to compute device identity?

I’ve seen elsewhere that it uses the Zymkey serial number, the device serial number, and the SD card serial number. However, what happens if I’m booting from a USB device and there is no SD card inserted? Alternatively, what happens if I am booting from an SD card, but there’s a USB storage device attached when I bind the Zymkey to the board?

Essentially, aside from the SD card and the device serial number, are there any other changeable factors that will be included in the device fingerprint?

The Pi serial number, Pi wired Ethernet MAC and the SD card CID.

It is advised to always have an SD card in the system even if the Pi is configured to boot solely off of USB media.

Allowing other unique credentials to be supplied per customer request is under consideration.