The user-side upgrade process verifies that the firmware checksums match.
The actual cryptographic verification (i.e. "this firmware is official") is done by the Coldcard bootloader during the insta...
But no pgp verification? Where do you get the "good" checksum to compare against?
1