SkieDo Skie rules keep working with no internet because they are cached and signed?
Yes. Every policy bundle is cryptographically signed, and the device stores its current rules locally. With no internet the device keeps enforcing them, and it only accepts new rules that verify. So a school tablet in a basement or a field phone out of coverage stays managed.
The idea is that enforcement should not depend on a live connection. When a device syncs, it receives a policy bundle for its place in the hierarchy: apps allowed, schedules, web filtering and the hardening switches. That bundle is stored on the device, and Android itself enforces the restrictions, because Skie is the device owner.
Signing is what makes the cache trustworthy. Each bundle is signed, and the device checks the signature before accepting it. Anything that does not verify is rejected. Together with a per-device key and identity, that protects the device from being fed fake rules by someone on the network.
Offline behaviour follows from this. Schedules still switch app sets at the right times, hardening stays on, and the Chrome rules remain in place. The filtering DNS is locked on the device, so it travels with it. Some networks block the encrypted DNS port, in which case the device uses the network's DNS and the dashboard flags it. Location reporting pauses until the connection returns, since there is nowhere to send it.
What does not happen offline is change. If an admin edits a policy, the device learns of it at its next sync, which comes when the connection returns or the screen turns on stale. The unlock gate and the Due limit decide how long a device may run on old rules before it must prove it is current.
Practical tip: for sites with patchy internet, use offline mode with its own allowed apps and a sensible maximum, so users have a defined fallback.