Certificate in DER format (x509 v3)
SHA256 hash constants, little endian
Very interesting to dig around in the firmware, I even found the boot splash image. Definitely a time sink, but fun. in the process of being planned or done
Thunderbird replacement is currently being planned, so I think it's correct.