> never sign any executable that can boot on shipped hardware unless you'd be ok with everyone running it on shipped hardware. How about if, when the lead engi

> never sign any executable that can boot on shipped hardware unless you'd be ok with everyone running it on shipped hardware. How about if, when the lead engineers are on holiday, you ship the first batch of production units with a root a key that’s on everyone’s laptop and has been pushed to bitbucket, and been used to sign all sorts of things for dev units? Then, when confronted with that, you say “oh right, well… can we delete it from those places and import the key to the HSM? We’ll use it as the prod key going forwards?” I was sad when that payment terminal never made it to market, but in the end perhaps it was for the best.