Either mdm installed packages, or munki catalogs named by the serial number of the device.

I could currently create assignment groups for each serialnumber but that is tedius. Even if automated, It would still clutter up the assignment groups screen. I'd want to see the device specific catalogs/assignment groups on the device page.

The use case here is the nebula "vpn" client which needs a per host certificate. I was thinking of delivering these host specific certs by .pkg