Asked boss should I do signature checking for firmware images in OTA updates. He said something like: they buy our hardware, I don't care if they install custom firmware on it.

Based.