Something like 'Secure Boot' / 'Measured Boot' on modern PCs, I imagine. A bootloader will checksum the current application before running it, checking its dig

Something like 'Secure Boot' / 'Measured Boot' on modern PCs, I imagine. A bootloader will checksum the current application before running it, checking its digital signatures and version and whatnot, and deriving an encryption key based on that.