Secure boot on a budget
A chain of trust does not need a security team. It needs three good decisions made early.
Most products do not need a hardware security module. They need a signed bootloader, an immutable root key and a firmware update flow that refuses to accept anything else.
We have shipped enough programs to know that the difference between a product that lands on time and one that slips by a quarter is rarely a single heroic decision. It is the accumulation of small ones, made early, defended quietly, and revisited only when the evidence demands it.
What the work actually looks like
Pick the silicon with a real ROM bootloader. Burn the keys at the factory, not in the field. Sign every image in CI, never on a developer laptop.
In practice the schematic, the layout, the firmware skeleton and the test plan start in the same week. Not the same quarter. The same week. The team is small enough that one engineer can hold the whole picture in their head, and disciplined enough that nobody pretends to when they cannot.
A chain of trust does not need a security team. It needs three good decisions made early.
Where it usually goes wrong
The failure mode we see most often is not technical. It is a handoff. A spec leaves one team without the context a second team needs to act on it. Two weeks later, something obvious has been missed, and the cost of fixing it has multiplied by ten.
- One owner per decision, named in writing.
- One review per gate, scheduled before the gate opens.
- One source of truth for the design, the BOM and the test plan.
- One number that says whether the program is on track this week.
Three decisions. Six weeks. A product that survives the day a researcher decides to poke at it.
The quiet result
A program run this way feels boring from the inside. There are no rescue missions. There is no hero week. The board enters the lab, passes, and goes into production. The line calls once, to say the first thousand units shipped clean.
That is the work. It is not glamorous. It is the only way we know to build hardware that survives the year after launch, and the four years after that.
