It may be true that TLS x.509 PKI is broken in the context of embedded devices, sure. But that's not the problem being discussed here. The first problem is tha

It may be true that TLS x.509 PKI is broken in the context of embedded devices, sure. But that's not the problem being discussed here. The first problem is that certs used to sign a lot of firmware seem to be test certs. The second problem is that (unless the OP misunderstands firmware signing) a lot of the certs were expired at the time the firmware was signed. All in all this just seems like something that should be enforced through a standards body. Like, to get FCC or customs approval, or some other checkmark that allows selling your product, show that all your software was signed properly.