but what part of the pipeline is responsible for the verification of the 'unmodified' trait?

If it's a part that's open-sourced (hardware or software), then won't it simply be _modified_ to allow it to pass and allow extraction of decrypted content?

If it's _not_ open-source, then you don't have a fully open-source DRM scheme.