The Keywriter certificate blob uses a layered security approach combining digital signatures and encryption. The OTP configuration data is encrypted with a randomly generated AES-256 session key. This session key is then encrypted using the TI-FEK (TI Field-Encryption Key), verifying only authentic TI firmware with the corresponding private key can decrypt it. The entire certificate is signed using SMPK (Secondary Manufacturer Private Key) for authentication. Optionally, the certificate can be dual-signed by also using BMPK (Backup Manufacturer Private Key) to enable key rotation scenarios. For complete keywriter blob generation flow refer Figure below.

Figure 2-1 Certificate Blob Generation Flow: AES Encryption, TI-FEK Key Wrapping, and Dual-Signature Authentication