It turns out, a lot of smartphone vendors are extremely sloppy and lazy, and they sign their partitions for Android Verified Boot with the AOSP testkeys, which are publicly available, on retail devices. Who would have thought?
If you can get a vbmeta partition from your device, you can use avbtool info_image to view the hash for the public key. Oftentimes, you can directly google this hash and that will usually give you the (lack of) information to determine whether or not it is a known key, especially the AOSP test keys. If you want a more definite yes/no answer, you can use this test_avb_key python script, which includes the AOSP test keys and a few known keys from vendors inside of the repository. It is used as such: test_avb_key.py [vbmeta.img] ./sample/aosp/external/avb/test/data/
With the private key, you are in principle able to re-sign a partition checked by AVB with entirely different contents, which could enable custom ROMs / alternate operating systems without an “unlocked” bootloader. This is currently left as an exercise for the reader, but this repository seems helpful for these purposes.
Any contributions of known private keys that are not AOSP test keys or otherwise linked on this page are very welcome.
For search purposes, here are the public key hashes of some commonly-used AOSP testkeys:
cdbb77177f731920bbe0a0f94f84d9038ae0617d (testkey_rsa2048)
2597c218aae470a130f61162feaae70afd97f011 (testkey_rsa4096)
5227b569de003adc7f8ec3fc03e05dfbd969abad (testkey_rsa8192)