Most likely the patches will require digital signatures by Apple and the kernel will verify the signatures before allowing itself to be patched. Most likely the

Most likely the patches will require digital signatures by Apple and the kernel will verify the signatures before allowing itself to be patched. Most likely the signatures will be compiled into the kernel itself and not be part of any external configuration file. Not a great vector.