How to validate system after provisioner completes

[octal-ip]

As a matter of best practice, I'd like to validate that devices I've provisioned with this tool are secured and ready for deployment.
To do this, I'm guessing I would need to validate that:

1. Secure boot is enforced and active, using my signing key (as specified in CUSTOMER_KEY_FILE_PEM).
2. The correct firmware version is running (as specified in RPI_DEVICE_FIRMWARE_FILE).
3. A unique device specific encryption key was written to OTP.
4. The above device specific encryption key is being used (and must be used) to decrypt and boot my OS image.
5. JTAG is disabled.

I've been searching through the documentation, but I haven't been able to find a solid path through verifying each of these items.
I think it'd be a great addition to the documentation, as it would give users of this tool a reliable method of checking the security of their devices, rather than just assuming it's all working properly.

[tdewey-rpi]

Feature request accepted.

I've actually had something along these lines scheduled for next week already - so I'll roll this into my existing schedule.

[tdewey-rpi]

Early docs available at #192, I'd appreciate any feedback before merging.

[octal-ip]

Thanks! I've added some comments in #192