Secure Boot Chain
Each boot stage verifying the signature of the next before executing it, anchored in immutable hardware, so only authorised software runs.
Physical access defeats software controls. An attacker with a device in hand can rewrite its storage, and without a hardware anchor there is nothing to prevent the modified image from running.
The chain begins in read-only hardware — a boot ROM that cannot be altered — holding a public key. It verifies the bootloader's signature before executing it; the bootloader verifies the kernel; the kernel verifies the application image. Any signature failure halts the boot. Each link is trustworthy because the one before it verified it, and the first link is trustworthy because it is physically immutable.
Attestation extends this outward: the device produces a signed statement of what it measured during boot, and the backend can refuse to enrol or issue credentials to a device whose measurements do not match an expected set. That is what turns local integrity into something the rest of the system can rely on.
The two operational hazards are worth planning for. Key rotation must be possible, or a compromised signing key means the entire fleet must be replaced. And the recovery path for a device that legitimately fails verification — corrupted storage rather than tampering — has to exist, or ordinary hardware faults become unrecoverable.