This presents a completely new kind of threat. I wonder how the industry would respond to this. When you do a fresh install, perform some kind of checksumming to verify the integrity of the OS with all its installed software. This cannot possibly be implemented by Google because each manufacturer has its own bloatware that it needs to pre-install. I wonder if Samsung and LG will wake up to this and create a security module?
Actually, the signature checks would have to be done by an external hardware component, or maybe through something like ARM TrustZone. Otherwise, the attacker could disable or manipulate the checks when installing the malware.
So it's up to the phone manufacturers to implement; Google would never be able to implement this in a truly secure fashion, even if they knew all the software installed on the phone a priori.
On a related note, I know that Cisco wants something like this for their hardware, but at runtime instead of just on-boot.
Only problem with chromebooks is that the default action is to wipe the system instead of booting. You have to press ctrl d to boot, which the UI does not tell you about.
My question then becomes: where is the manufacturer's certificate stored on the phone/laptop? Because if it isn't stored in a secure manner, an attacker could still modify the ROM and replace the certificate, and you would be none the wiser ;)
You are aware that e.g. Android ROM is flashable? So it's not a ROM in the literal sense -- probably EEPROM or something. I'd imagine an actual ROM (non-erasable) would only contain the bootloader and/or BIOS. So the manfacturer could sign those and check them, but everything afterwards would be modifiable.
Let's assume that the manufacturer places its cert in ROM so nobody can change it. Great! We are totally secure! Actually, not at all. Where does the signature check take place? In software? Then an attacker could man-in-the-middle and feed the signature check function with a malicious cert. Even if this was not a problem somehow, how would the manufacturer handle key revocation? The cert is burned in, so if their key is compromised, every single device out there is broken.
In summary, unless every single step of the signature check is performed in an isolated environment (e.g., TPM), an attacker will always be able to circumvent the process. Solid crypto is not enough; you need to also ensure that the crypto implementation is tamper-resistant!
It's not news that the indifferent, the ignorant, and the uninformed are screwed, or that some things are difficult to solve without individual knowledge and action.
