I had a cool idea for WiFi password provisioning once: it's possible to modulate the packet _length_ to transmit the SSID and the password. A new IoT device obviously can't decrypt the packets, but it can observe their length.
I even made a sample implementation for Linux. Unfortunately, I couldn't find a single IoT chip that would give low-level access to the PHY good enough for this :(