I like that matter provisioning requires verification of their certificate, but I don’t like that certificates can expire or the certificate authority can shut down. Although maybe that’s all taken care of by the DCL? In which case that’d be fine.
It's also pretty obnoxious that it requires an Android phone with Google play services enabled (and even a Google login IIRC) or an iOS phone. There are ways around this, but they are pretty complex and not well documented.