A node joining Ethereum, or coming back after a long time away, has to start from a recent checkpoint it gets from someone it trusts.
The idea: Proof of stake can only punish keys that still have stake behind them. Once validators exit, their old keys are free to sign anything, including a fake history branching off long ago. A node that watched the chain all along knows which history is real. A newcomer starting from genesis doesn't. A recent checkpoint from a trusted source closes that gap, because a fake history would have to branch off after it, while those validators still had stake to lose.
Why it matters: Otherwise validators who already left could use their old keys to fake a convincing alternative history.
On the map: new or long-offline nodes and light clients start from a recent finalized block (weak subjectivity)
Proof of stake has a weakness proof of work doesn't: validators who have exited and withdrawn can still sign, and their old keys cost them nothing. Collected or bought, such keys could build a convincing alternative history branching off long ago, a long-range attack[1]. Nodes that stay online follow the real chain, but a new node, or one offline for longer than the weak subjectivity period, can't tell the two histories apart from genesis alone.
So new and long-offline nodes start from a recent finalized checkpoint obtained from a source they trust (checkpoint sync from a provider, a friend's node or a block explorer), and nothing before it can be reverted[2]. Light clients likewise start from a trusted block root[3]. The trust needed is mild, one honest source for a recent checkpoint, but it sits outside the protocol.
If any of these breaks, this breaks too.
If this breaks, these break with it.