Comment by layer8

By requiring signed firmware and holding the signing keys.