Most chips have a TPM which holds a key. You can’t access the key without expensive and specialised equipment. The key is signed by the manufacturer’s key (goog

Most chips have a TPM which holds a key. You can’t access the key without expensive and specialised equipment. The key is signed by the manufacturer’s key (google, in this case). The TPM has an API that returns a signature of the running OS code. If you tamper with the OS, you get a signature mismatch.