Ro.boot.vbmeta.digest -

But the story is not only about failure modes. There is a quiet heroism in ro.boot.vbmeta.digest. It is the line that keeps your messages private, that prevents attackers from slipping malicious kernels into secure devices, that holds chain-of-trust together across millions of updates. When the world is noisy with apps and exploits, the digest is the ledger’s seal.

: High-security applications and Google's SafetyNet (or Play Integrity) check this digest to ensure the device has not been tampered with. Technical Details ro.boot.vbmeta.digest

This is where our keyword enters the stage. But the story is not only about failure modes

The vbmeta partition is the first thing the bootloader verifies after the boot ROM. If vbmeta is corrupt or unsigned, the device refuses to boot. the device refuses to boot.