I have a bunch of IoT devices which can do ECDH/ECDSA and AES. They all are connected to some server and know its public key. In turn, server knows each public key of the corresponding device. Devices do not know about each other, only their master-server and its public key.
What I want is to get rid of ECDH for most of the time and to let all the devices to securely know about some common key that can be used to broadcast messages using AES and which (optionally) could be switched to a new one after some time.
So, the naive idea is for devices to securely "ask" server for a new AES key and its expiration date every time they get online. Or re-ask if they get decryption error.
Does it sound sane? Or should I consider some other group key establishment protocol?
By securely "ask" I mean some proper way of communicating like noiseprotocol/TLS