The public keys are provided by the developer. Google, or Apple, for example. It's how they know that nothing was tampered with before it left the factory.

▲

realusername an hour ago | parent [-]

Nothing has been tampered with doesn't mean there's no factory backdoor, it just only means same as factory, nothing more.

	▲	petcat an hour ago \| parent [-]
		Apple or Google know what the cryptographic signature of the boot should be. They provide the keys. It's how they know that "factory reset" does not include covert code installed by the factory. That's what we're talking about.