Do you still use enrollment keys, but you're adding client cert / keys additionally?

Yes. Effectively you're adding the client auth as an extra layer and you'll have to implement that separately from Fleet.

thank you 😄