secure_boot_gatekeeping_2.c

// Add at line XXX:XXX

/* TODO: replace this with a constant encoding 
    the manufacturer's public key: */
uint_t pk_m[32] = {\xDE, \xAD, \xBE, \xEF, ...};

extern uint8_t boot_image_certificate[64];

// Add at line XXX:XXX
if (!verify signature of hash with pk_m) {
  // PANIC
  // TODO: print an error here
panic:
  goto panic;
  __builtin_unreachable();
}