Lobsters: Bypassing Signature Verification in U-Boot SPL