Verifying before you flash, and the tiers

Tier 0 is building the card yourself, checking its hash, and reading it back after writing. It costs nothing irreversible and is the only tier that works on any board.

Tier 1 is the dm-verity tree on this card. It DETECTS modification of the system partition and does not prevent it. The root hash sits on the boot partition, outside the tree, so an attacker who rewrites that partition supplies their own hash and the device displays it.

Only tier 2, a signed boot chain, closes that. It burns one-time fuses and stays in phase 7.

docs/VERIFICATION.md says what each tier actually proves. Read it before relying on one. To check without a Pi, see Check it yourself.