I was thinking more along the lines of signature verification, but I forgot that any spoofed device could just supply a signature it got out of a device, so I t

I was thinking more along the lines of signature verification, but I forgot that any spoofed device could just supply a signature it got out of a device, so I think you're probably right.