Verified Boot has been on Android devices since version 4.4. Mark, an attacker, installs a custom bootloader on a stolen device with Android version 8. When it boots up, Mark sees an error on the screen that the device cannot boot. What is preventing the device from booting up?

The correct answer is that the root of trust stored in hardware does not match the newly installed bootloader. Android's Verified Boot feature, present since Android 4.4 and strengthened in later versions like Android 8, ensures the integrity of the device's software from the bootloader up to the system partition. It does this by cryptographically verifying each stage of the boot process. The device has a hardware-backed root of trust that stores cryptographic keys. When Mark installs a custom bootloader, its signature will not match the expected signature verified by the hardware root of trust, leading to a boot failure or an error message. Incorrect options: Restarting the bootloader will not resolve a cryptographic mismatch. Safe mode is for troubleshooting software issues after a successful boot, not for bypassing Verified Boot. Rate limiting applies to passcode attempts, not to the boot process itself.