&gt; Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software&#x2F;firmware updates, but that Apple cannot push malware to at some later time?<p>I&#x27;ve been thinking about a related question: how to construct an update system so the updater cannot push malware to a <i>specific</i> phone, without making it visible and available to everyone else?<p>My answer would be something like Certificate Transparency (<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Certificate_Transparency" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Certificate_Transparency</a>). The update system would only accept an update if it&#x27;s signed by several independent entities, spread all over the world (in many independent jurisdictions), and the signing system in these entities would be designed in such a way that every signature is written to an append-only log which is published to everyone to see, and these entities would also publish a copy of every update they signed.<p>That way, Apple could still push malware to a phone, but they couldn&#x27;t push malware to a phone without making that fact public, at least to security researchers who can reverse-engineer firmware updates.