A validation process is a good idea but I'd still feel safer if the device were frozen with no way to update firmware. Many microcontrollers have "e-fuses" which you can blow post-manufacturing to render the program flash read-only, for example. One can also pot the board in epoxy to make tampering more difficult.