12.3.2.3 Firmware Image Validation – Unsecured Mode
In the Unsecured mode, the device is not checked for the authentication scheme that needs SECURE_BOOT_KEY.
If the device is unsecured (and SECURE_BOOT_KEY is invalid and the Device Secured state is not set), the bootstrap code looks for valid images (valid sequence number, header and more). Root of trust cannot be possible in this scenario.