* If you save secrets with application A, then install evil application B, it can't access the secrets from A.
* And if you revert back to A, those saved secrets will still be there.
What stops app B from pretending it's an app A ?
* And if you revert back to A, those saved secrets will still be there.
What stops app B from pretending it's an app A ?
2. Firmware in ROM does unconditional measurement of the first mutable boot stage, which is loaded from the host, over USB.
The KDF used for measurement is Blake2s(UDS, Blake2s(application), USS).
Note that when I say hardware I mean FPGA hardware design.
If you're asking about applications running on the device (Tillitis Key) the answer is measured boot. You can read more on tillitis.se.
A bootloader will checksum the current application before running it, checking its digital signatures and version and whatnot, and deriving an encryption key based on that.