Worth noting, image authentication is somehow not done when upgrading/downgrading firmware thru TR069. Seems to only run when upgrading firmware using the web UI or USB key (assuming one had somehow obtained the USB token)
That said, TR069 configuration can only be done thru their VPN since they remembered to protect the config this time around (compared to G3100)