Signed OTA Firmware Rollout & Rollback Protection

This simulator models how a real IoT fleet accepts or rejects an over-the-air firmware package. A 64-device fleet starts on a vulnerable firmware version; you choose a package — a properly signed patch, a tampered package with a forged signature, or a validly-signed downgrade attempt — and push it out in staged waves. Each device independently runs the same two checks every real secure-boot OTA pipeline runs: cryptographic signature verification against the publisher's trusted key, and an anti-rollback monotonic version counter that refuses to accept anything not strictly newer than what's already installed. Toggle either protection off to see exactly which attack it exists to stop, and watch the live event log and attack-surface readout track the fleet's security posture wave by wave.