One answer is this: you bake the first program that runs right into the hardware. That way, it’s tamper-proof, and you have a trusted starting point (the primary bootloader, in our case). It then ...