> the validated configuration boundary That's the part people miss, the cert is about a very specific module image plus mode, not the thing sitting in the rack six months later. Once you let a startup flag or key-wrapping convention drift, you're already outside the box (and the validator still gets counted as if nothing changed....)