Recent keyless car thefts via CAN injection show how vulnerable unprotected in-vehicle networks are. MACsec with MACsec Key Agreement (MKA) prevents message injection at the link level, but, as so often, cryptography turns the problem into a key management problem. Today’s approaches rely on SHE-based key update protocols or proprietary OEM solutions, which can go wrong. We propose YANG-based key management integrated into a software-defined networking (SDN) architecture: reusing the standardized IETF keystore and truststore models, encoded in CBOR and accessed via CORECONF over DTLS-secured CoAP, an SDN controller can securely install and update connectivity association keys (CAKs) in ECUs throughout the vehicle lifecycle, from end-of-line key injection to runtime key updates.