You are aware that e.g. Android ROM is flashable? So it's not a ROM in the literal sense -- probably EEPROM or something. I'd imagine an actual ROM (non-erasabl

You are aware that e.g. Android ROM is flashable? So it's not a ROM in the literal sense -- probably EEPROM or something. I'd imagine an actual ROM (non-erasable) would only contain the bootloader and/or BIOS. So the manfacturer could sign those and check them, but everything afterwards would be modifiable. Let's assume that the manufacturer places its cert in ROM so nobody can change it. Great! We are totally secure! Actually, not at all. Where does the signature check take place? In software? Then an attacker could man-in-the-middle and feed the signature check function with a malicious cert. Even if this was not a problem somehow, how would the manufacturer handle key revocation? The cert is burned in, so if their key is compromised, every single device out there is broken. In summary, unless every single step of the signature check is performed in an isolated environment (e.g., TPM), an attacker will always be able to circumvent the process. Solid crypto is not enough; you need to also ensure that the crypto implementation is tamper-resistant!