Now you have a number of thorny design decisions.<p>For example, can the user change their own key? If yes, the device can never be trusted second-hand - the OS might have been modified to secretly accept more keys. If no, then the device also can never be trusted second-hand - the previous owner could well have retained the key. And which key is superior, the manufacturer key or the user key? Can the possessor of a key override actions attempted using the other key?<p>Also, as written, this is just a bad solution. So you ask the user on initial setup. Let&#x27;s say 99% of users won&#x27;t know what the question is asking. So maybe they hit &quot;yes&quot;, and now we&#x27;re just back to iPhones and no user freedom, for them or any subsequent device owners. Or maybe they hit &quot;no&quot;, and now they&#x27;re no more secure and there was really no point in asking them. Maybe it&#x27;s a 50-50 split, depending on how they feel (and not related to how they would choose given informed consent). Or maybe the user is informed, in which case they are very likely to just hit &quot;no&quot;, if for no other reason than to preserve the resale value.<p>Don&#x27;t get me wrong, I do think this could be done right. But attempting to guarantee &quot;security&quot; (that is, the dubious sort of security that is manufacturer-only updates) to naive users, freedom to power users, and <i>preserve</i> those guarantees as the device changes hands... well, that&#x27;s a Hard Problem. I think only Chromebooks have attempted it so far.