A signature decides whether a device accepts an update, not who can read it. Two ways to encrypt firmware updates, a shared product key or a key per device, where the plaintext and the keys exist, what one leaked key exposes, and what the CRA asks for.

Secure boot decides what may run. A signed update decides what gets installed, and its security comes down to who holds the signing key, a second signature at boot, and anti-rollback. What the CRA expects, and three questions for your own product.

Secure boot on a Linux gateway is a chain of five or six verified links, each with its own key and its own trust anchor. Count the links, count the keys, and ask of each: where is it, who may use it, is there a record.