secure boot: Functional partition table & app signature verification

components/bootloader_support/include/esp_image_format.h

@@ -107,7 +107,7 @@ esp_err_t esp_image_load_segment_header(uint8_t index, uint32_t src_addr, const
  *
  * Image validation checks:
  * - Magic byte
- * - No single section longer than 16MB
+ * - No single segment longer than 16MB
  * - Total image no longer than 16MB
  * - 8 bit image checksum is valid
  *

components/bootloader_support/include/esp_secure_boot.h

@@ -60,7 +60,9 @@ static inline bool esp_secure_boot_enabled(void) {
  */
 esp_err_t esp_secure_boot_permanently_enable(void);
 
-/** @brief Verify the signature appended to some binary data in flash.
+/** @brief Verify the secure boot signature (determinstic ECDSA w/ SHA256) appended to some binary data in flash.
+ *
+ * Public key is compiled into the calling program. See docs/security/secure-boot.rst for details.
  *
  * @param src_addr Starting offset of the data in flash.
  * @param length Length of data in bytes. Signature is appended -after- length bytes.