On each connection. Or boot. Whenever you need

Edit: to be clear, this would still be vulnerable to mitm attacks without a user entered password on top but at least you can't just read the secrets from the bus. E2: And having a password wouldn't be fully secure without such a scheme neither