(At this point it's less "assume good faith" and more "halfheartedly check for the unlikely event that any good faith is present", but...) How do you insure th

(At this point it's less "assume good faith" and more "halfheartedly check for the unlikely event that any good faith is present", but...) How do you insure that the end user is able to replace the hardware key and bootloader with one of their own devising (and generally to tamper with arbitrary parts of system) without a remote vendor/employer/DRM firm being able to prevent or detect it?