> If the attacker has total control, then all bets are off no matter what mechanisms you put in first. You could have a second SoC on the device running off RO

> If the attacker has total control, then all bets are off no matter what mechanisms you put in first. You could have a second SoC on the device running off ROM, whose only purpose is handling this safe mode and controlling internet access of the main device. Keep it simple and make it essentially just a fuse that can be blown (turning off internet access) by a signed message from the manufacturer. Keep the hardware capability of this SoC to just that, so even if you have a vulnerability on that thing itself, an attacker can't really do anything with it. Keep the code running on that SoC simple and preferably make it a FSM that is proven to be free of vulnerabilities. Also make sure the main device can't interfere with it in any way. Once the fuse is blown, the user needs to press a physical button on the device to re-enable internet access. Preferably ship the devices with this internet access disabled by default. Even better yet, don't build an internet connected oven... but that ship has sailed in many areas.