This attack is interesting.
But it seems to boil down to verified firmware. Still figuring it out though