You've obviously never been involved in the design/manufacture of an ASIC. What you're proposing will take roughly 2 years, and be an organizational nightmare.

You've obviously never been involved in the design/manufacture of an ASIC. What you're proposing will take roughly 2 years, and be an organizational nightmare. 'Just' having an embedded identity is already complicated: 1. Where do you store the identity? Fuses in the ASIC? Now you need a fuse bank. Not every process node supports fuses, so you may now have to port you entire design to a new process node. 2. Using this new-fangled identity means you can now perform a handshake with the host. Let's 'just' put down an ECDSA accelerator. What do you mean, this increases the die size by 33%? What do you mean it needs to be resistant to differential power analysis? Oh, right, because stealing a single identity means you can make as many clones as you'd like, and we can't revoke identities if we think they're stolen because of laws in China! Etc. etc. the second option doesn't even work because the cloned device will simply ignore the signature on the firmware. I used to think this was all trivial too, but having been through this _exact_ wringer 4 or 5 times before I can tell you it is Hard(tm).