And is also the first of many steps to making a rootkit toolchain that can infect your devices when they’re in the possession of an attacker.

Any device that allows an anonymous third party to modify it is a device that cannot be trusted once it’s been handed to a third party.

Would you be willing to register for an identity certificate to make use of an open source toolchain with your registered device, so that you could be certain others had not silently rootkit’d it and were spying on your work?