Bypassing secure boot with a $40 voltage glitcher
A glitch at the right moment skips the signature check in the boot ROM. Most of the work was finding the timing. The bug is in ROM, so it cannot be patched.
The full write-up for this one isn't online yet.