A secure boot chain is a sequence of startup checks in which each stage verifies the next before it runs. It typically begins with a small, trusted code component-often immutable boot ROM-and continues through firmware and the operating system. Digital signatures and cryptographic keys help ensure that only authorized software loads.
This matters because boot code runs before many operating-system protections are active. If an attacker with physical access can alter an early stage or bypass its checks, later defenses may be undermined. In an offline phone used to store a wallet recovery phrase, network disconnection does not prevent local tampering; however, a boot-path weakness alone does not prove that stored data was accessed. Secure boot helps detect or block unauthorized startup software, but it does not replace protecting secrets, keeping devices updated, or securely erasing retired devices.