I think the distinction is: physical access helps bootstrap the research, but the resulting key/signing logic is not device-specific