Sure, it's not hard, then you get into side channel, first-use-trust/update, MITM, etc territory.