The real OT boundary is not the firewall - it is the command that moves a breaker, valve or pump. This paper makes the case for cryptographically signed actuation, treating every control command as a credit decision.