Embed Notice

@pid_eins @siosm

to be frank I just don't want to think about how trustworthy it is and just dump the entire state into the trash.

You're making things way more complicated than they should have to be.
Now one actually needs to check if the chain of trust is still valid or if the attacker was able to just use e.g. some exploit to disable secure boot (or it may not even have been enabled to begin with) or re-signed parts of the trustchain using and so on...