And how do you know the signing keys are legitimate? Are they in a hardware root of trust for a high security, completely locked down device that can’t be roote

And how do you know the signing keys are legitimate? Are they in a hardware root of trust for a high security, completely locked down device that can’t be rooted to sign whatever? Is the CA that endorsed them trustworthy? There is not a tech solution to this problem.