You don’t need signing, you need a way to make changing a boot path impossible by anyone who is not the user or the OS (or at least, tamper-evident on reboot).

You don’t need signing, you need a way to make changing a boot path impossible by anyone who is not the user or the OS (or at least, tamper-evident on reboot). Simply storing hashes that are set on first boot (much like SSH does with known host hashes), and allowing the user/OS to reset the hashes, will be sufficient. M1 does this, as far as I know. > Remote attestation because you can NEVER trust the client. IRL, I don’t carry a weapon everywhere I go, because it’s clearly overkill. For this exact reason, overkill measures like remote attestation should not be a thing on general purpose computers.