Agreed. Even if firmware updates need to be signed using threshold signatures generated by hardware security modules stored in vaults, updating firmware for an

Agreed. Even if firmware updates need to be signed using threshold signatures generated by hardware security modules stored in vaults, updating firmware for any safety-critical domain (aircraft, medical devices, industrial robots, etc.) should require physical access. On a side note, did anyone else brick more than one WRT-54G WiFi AP before learning that the factory firmware didn't handle corner-case HTTP POST cases generated by FireFox? (Once, shorting two pins got TFTP working again and I could re-flash. The other time, it was really dead.) I really wish even IoT devices had a factory boot ROM with minimal "limp home" (in the case of cars, almost literally) functionality plus an ability to update flash-stored firmware. If the device uses a formally verified realtime microkernel, then it could probably get away with not being able to update the kernel over the lifetime of the device.