Hardware root of trust
A key or code fragment in silicon that the rest of the boot chain has to trust, because it cannot be changed in the field.
Every secure boot step builds trust upward from something no software can overwrite: ROM code or a key burned into fuses. This is simple to design and hard to repair. If the root is broken, no later step can fix it, and a software patch will not help.
Examples include the endorsement key in a TPM and Apple's Secure Enclave. Anyone who gets at the root gets everything built on top of it, which is why manufacturers put so much effort into that one piece.