Secure boot only proves who signed an image, not that it is safe. Four recent CVEs in FatFs, U-Boot, RAUC and UEFI (PKfail) show the three ways signed firmware fails, and the one that signing and key management actually prevent.