... But the bootloader can assure me that it's dormant and not spying on me as my operating ...
... your bootloader for a signed hash of itself and verify that the signature of the hash ...