What about having the private key all components are signed with shipped on a USB drive (the SecureStick™) to you with the phone? It could be encrypted with you

What about having the private key all components are signed with shipped on a USB drive (the SecureStick™) to you with the phone? It could be encrypted with your AppleID, so it's safe during transit. To re-sign new components, you plug the SecureStick™ into the phone, and it will try to connect to any other of your devices (that you of course also trust) to unlock the key. In a repair shop, they could swap out the component and you then re-sign everything with your SecureStick™ when you come in to pick the device up. You have to trust the repair-shop, obviously. Alternatively, you could re-sign all components with a private key you generate yourself? But then there's no guarantee that nobody else did just that in transit.