Edge devices must digitally sign model packages and firmware and support rollback, weights must be stored encrypted, and keys must be rotated regularly.