Or even if the device is authentic, every bit of data has to be assiduously validated because there’s known evidence of modifications after it left the repair shop. DKIM signatures did that for some emails but a lot of stuff has no obvious path to validate like that and now the repair shop guy is expressing concern, too:

https://www.washingtonpost.com/politics/2022/04/12/now-warni...