Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be

Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system. Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.