HS-FS in a TI K3 SoC banner explained

HS-FS stands for High-Security Field-Securable and is one of three TI K3 silicon-security states you'll see in a U-Boot banner:

• GP (General Purpose): no signature verification. Silicon accepts any image. Development-only; TI does not ship modern K3 silicon in GP.
• HS-FS (High-Security Field-Securable): signature verification is active in the boot ROM and TIFS firmware, but the OTP customer keys have not been burned yet. Silicon still accepts TI-signed or vendor-test-signed images. This is what you get on a TI Starter Kit board like the AM62A7 SK.
• HS-SE (High-Security Security-Enforced): customer OTP keys have been burned. The silicon only accepts images signed by the customer's key. This is what should ship on a production board.

The SR1.0 in the same banner line is the silicon revision. DMSC firmware ABI compatibility windows are tied to silicon rev, so a customer board on SR2.0 won't necessarily accept the same DMSC firmware image that works on SR1.0.

If you're staring at a production board still shipping HS-FS, it means the OTP provisioning step never happened: the customer forgot (or explicitly declined) to burn their own root of trust. Whether that's a bug, a supply-chain concern, or a deliberate choice depends on the product.