On-device signing: Switch to using a TEE-backed keystore key.
We previously used a Strongbox key; but since we'll need to start
verifying the public key component with an HMAC operation on every boot,
switch to a TEE key instead, as TEE operations are much faster, and
this should help bring boot time down.
This also requires some logic to deal with keys in Strongbox on
updating devices.
Bug: 187862706
Test: TEST_MAPPING; manual upgrade test.
Change-Id: Ib99d689dbef02d2f0c34bfa4c852205b1ec680a7
Merged-In: Ib99d689dbef02d2f0c34bfa4c852205b1ec680a7
1 file changed