The one moment nothing can verify
Bootstrap trust is the trust extended at a system's very beginning — the first administrator account, the first signing key, the first policy — none of which can be authorized by a mechanism that doesn't exist yet to authorize it. This is structurally different from every authorization decision that follows, which can at least be checked against something already established; the bootstrap moment has nothing to check against.
It's tempting to treat this moment as a formality to get past quickly on the way to the 'real' system, but it's actually the foundation everything else inherits its legitimacy from. A poorly controlled bootstrap — an initial credential set carelessly, an unclear record of who was actually present — leaves a gap at the very root of the system that no amount of rigor applied afterward can retroactively close.
Shrinking the window rather than pretending it away
Because this moment genuinely can't be secured the way later access is, the practical response is to treat it with deliberate, separate attention — documenting exactly who was involved and what they did, and moving as quickly as possible from 'nothing exists to check against' to an actual, auditable system governing everything that follows. Minimizing how long the system operates in this unverifiable state is usually more productive than trying to make the bootstrap moment itself somehow verifiable, which it fundamentally can't be.