Just to be clear I think the syntax that says: ziti edge enroll berlhome.berlcloud.jwt is misleading as you don't actually run that command on the controller you just do the usual enrollment process by giving the device you want to enroll the one-time-token and enrolling it. It took me a while to figure out why trying to running that command on the controller was just giving me a weird error.