What about a secure mqtt client

Yes, I think you can do it fine on the Pico as you have TLS there? it's literally just MQTT but over TLS

https://www.espruino.com/Reference#tls

Not tried recently, but this should work:

var options = url.parse("localhost:1234");
options.key = atob("MIIJKQ ... OZs08C");
options.cert = atob("MIIFi ... Uf93rN+");
options.ca = atob("MIIFgDCC ... GosQML4sc=");
  var mqttoptions = { // ALL OPTIONAL - the defaults are below
    client_id : "random",   // the client ID sent to MQTT - it's a good idea to define your own static one based on `getSerial()`
    keep_alive: 60,         // keep alive time in seconds
    clean_session: true,
    username: "username",   // default is undefined
    password: "password",   // default is undefined
    protocol_name: "MQTT",  // or MQIsdp, etc..
    protocol_level: 4,      // protocol level
  };

var mqtt = require("MQTT").create(null, mqttoptions);
require("tls").connect(options, function(client) {
  mqtt.connect(client);
} );

certs can now be in storage too.

If this works please can you let me know? It'd be nice to add to the MQTT page