Trigger and licensing path security is unresolved

Ma et al. assume the trigger path stays within the same trust domain as the throttle. They note that an externally sourced trigger from a trusted authority may be intercepted or blocked by the model or by adversarial humans. They state that the trigger must be cryptographically validated and point to prior kill-switch work, but they treat detection and triggering as separate from the throttles they evaluate ¹. O'Gara et al. list the scalable verification of license authenticity, and how licenses should be issued, as open questions ³.