We cover secure boot, key rotation, update signing, and minimal attack-surface provisioning.