What I don’t understand is why they don’t employ a second pair of keys, that the console only has the public key part of. Encrypt with one key pair, sign with

What I don’t understand is why they don’t employ a second pair of keys, that the console only has the public key part of. Encrypt with one key pair, sign with another. And if the console had the public key part only of the signing key, it could first verify the signature with that public key before decrypting the payload with private key of the key pair used for encryption. People would still be able to decrypt the firmware by extracting the private key, and they could still find exploitable bugs in the firmware, but they would be unable to sign custom firmware, since the console would not hold the private key of the signing keypair. Has it been confirmed that the private keys that have been extracted would allow one to run custom firmware on the PS5? Or is Sony already doing something like what I am suggesting here, and thereby protecting against custom firmware for the PS5?