public certificate is then stored in persistent memory 706 moving now to fig8 using the first key phrase 816 as a seed a hash function is calculated 808 over the software image 804 in flash memory 800 the software image 804 includes the boot trusted domains device drivers and operating systems but excludes user data and applications a second text based key phrase 818 is entered and split against the flash hash word at 810 to create a flash hash key 812 the flash hash key 812 is then encrypted at 814 using the private certificate 820 and stored in persistent memory 806 the private certificate 820 and the second key phrase 818 are then cleared from the phone the verification phase is illustrated in figures fig9 and 10 the user may initiate a certificate challenge by entering the first key phrase 914 a hash of the first key phrase 910 is then used as an aes key to unwrap at 912 the encrypted public certificate stored in persistent memory 906 to reproduce the public certificate 916 moving now to fig1 the public certificate 1020 is used to decrypt at 1014 the flash hash key 1012 the first key phrase 1016 is also used as a hash seed to calculate a hash 1008 over the software image 1004 in flash memory 1000 the hash value is combined with the flash hash key at 1010 to recover the second key phrase 1018 if the recovered second key phrase 1018 matches the expected value then the integrity of the software image 1004 has been verified prior to being used for secure operations the health of the platform may be determined and all elements of the system.