> make each unit responsible for detecting its own faults and shutting up if it can't guarantee correctness Does this mean you have to trust the already compro

> make each unit responsible for detecting its own faults and shutting up if it can't guarantee correctness Does this mean you have to trust the already compromised system?