The operating system is not the root of trust. On this hardware the root is Titan M2, the discrete security module in the Pixel, together with the verified-boot implementation that module anchors.
What is bound
During provisioning, Theta generates the keys for the boot chain and seals them in Titan M2. The bootloader is not left in an unlocked state. The point of the binding is that a later image — from a cable, a compromised update, or a substituted partition — does not verify against those keys, and therefore does not boot as the device you were given.
What a power-on checks
- BootloaderThe first code that runs after the silicon is checked before it is allowed to load the next stage.
- System imageThe operating system partitions are checked against the keys in the secure element, not against a file the system itself could rewrite.
- Lock stateA device that reports an unlocked or warning boot state is not in the condition it left provisioning. Stop, and follow the verification article.
What this does not mean
Verified boot does not inspect the contents of a message, and it does not stop a person who knows the passphrase from using the device. It stops a quietly replaced system from pretending to be the one Theta provisioned. That is the property we guarantee.