After a large organization has completed the acquisition of a smaller company, the smaller company must implement new host-based security controls to connect its employees' devices to the network…

Distributing the company's private key is a critical security violation - private keys must never leave the server, and doing so would compromise the entire PKI infrastructure.

Distributing unique public/private key pairs to each device describes EAP-TLS mutual authentication, not EAP-PEAP, which only requires a server-side certificate.

EAP-PEAP establishes a TLS tunnel using a certificate installed on the RADIUS server, and the client supplicant must trust that certificate to verify the server's identity before credentials are transmitted. Installing a certificate on the RADIUS server and distributing it (or its CA certificate) to new devices allows those devices to validate the server and complete the PEAP handshake securely. This is the correct integration approach without exposing private keys or requiring a full mutual-certificate PKI.

Installing a supplicant is a necessary step, but self-signed client certificates generated per device would not be trusted by the RADIUS server under EAP-PEAP without explicit enrollment in a trusted PKI.