Antwort auf: Ist mein trezor Gerät sicher?
Basically if you had to put new-fresh-out-of-box device into bootloader mode by doing the bootloader button punch, then it must have been preloaded.
When the devices arrive from the factory they will always power-up into „ready-to-flash“ mode. Once firmware is installed they will boot up into operational mode and require that they be placed into ready-to-flash mode manually.
That’s how most people check.
As for the signatures, the board checks to bootloader, and the bootloader checks the firmware. To ensure that your bootloader is not corrupted, the easiest way is to check to see if the bootloader flashes. You can tell this by watching the bootloader version change from the factory version to the latest version. Since bootloader downgrades are „difficult“, it is not easy done once everything is up to date.