On firmware: Hermetry never signs firmware, you sign images in your own build and register only the public key. Do that, and turn on secure boot plus flash encryption on the S3, that covers the box side.
On firmware: Hermetry never signs firmware, you sign images in your own build and register only the public key. Do that, and turn on secure boot plus flash encryption on the S3, that covers the box side.