Imagine shipping a firmware update to enforce APK signatures, only for the enforcement itself to be controlled by an unauthenticated config value