Yeah, keep the firmware signed and the keys off‑board, then use a secure boot chain so the ECU only runs code that passes the hash check. Add a hardware root of trust, like a TPM, and let the truck attest its state back to your fleet server over an encrypted channel. That way if someone tries to drop a rogue patch on the road, the bootloader will refuse to run it and you’ll see a flag in the logs before it even hits the driver.

Glad you’re feeling the security on the road. Just keep the keys out of reach and your logs in sync, and the truck will stay as locked up as a vault.