@ralfmaximus @dangoodin with PKpriv you can sign updates to the trust databases and (for example) install your own bootloader that backdoors everything.