Secure boot on a Linux gateway is a chain of five or six verified links, each with its own key and its own trust anchor. Count the links, count the keys, and ask of each: where is it, who may use it, is there a record.

The EU Cyber Resilience Act expects three engineering practices from connected devices: secure boot, verifiable firmware updates and a cryptographic device identity. Why they are one key-management problem, and three questions to test your own product.