Any advice on tackling

no matching secret found

? This is my number 2 biggest err

This means the hosts don't have a valid enroll secret. You can see what osquery is sending if you add

--verbose --tls_dump

to your

osqueryd

invocation.