Trust at every layer: How sealed images extend OS integrity from boot to runtime (opens in new tab)

Consider a medical device running Linux in a hospital. It processes patient data, adjusts dosing, and reports to clinical systems. Or an ATM on a street corner, processing transactions around the clock. Or a gateway device at the edge of a manufacturing network, relaying sensor data from the factory floor. The operating system (OS) on each of these was verified when it was installed. But is every binary and library still exactly what was built? If you would demand that guarantee for a device ...