According to Wikipedia article
Before booting in the main Kernel, Samsung runs a "pre-boot" environment where it checks for the signature match of all elements of the OS.
If a method to get root that does not rely on the bootloader existed, would this bypass Knox? For example if an exploit was found? After the e-fuse for Knox is tripped, can it be untripped, or no because it's physical?