A bit more digging on the internet produced this document and a discussion of link keys in Zigbee.
https://www.digi.com/support/knowledge-base/zigbee-3-0-security
In this doc there is a discussion of link keys and the install code:
Install code derived link key - High security
Every device supporting Zigbee 3.0 is required to have an install code. The install code can be read by querying the I? command and it consists of a 16-byte install code + 2 byte CRC. The install code must be read from the joining node and entered to the trust center through an out-of-band method. Typically, the user would read an install code from some type of display or application on the joining node (it cannot be printed on label or physical unit). The user then provides the joiner’s install code and serial number to the trust center using a locally issued 0x24 registration API frame and setting bit 0 of the options field.
Using install codes for generating link keys is the most secure method, as it allows the user to clearly identify the joining node to the trust center and it guarantees that each joining device has a random link key.
In order for a joining device to use an install code, DC bit 0 (DC=1) must be set on the joining device. This generates a link key based on the install code and the KY parameter will be ignored.
I think this is what is needed, but I have no idea how to set the DC bit to 1 so it will generate a install code key.
Thanks again for your help.