How about this -- a jumper to update the firmware keys. System ships with third party certificate(s) (similar to the well-known certs your browser ships with).

How about this -- a jumper to update the firmware keys. System ships with third party certificate(s) (similar to the well-known certs your browser ships with). But with physical access you can update / supplement / remove keys as needed. Now that means normal users and IT depts can do all the updates they need, but if you have a need for your own private key you can do that too (after physically touching hardware). Oh and for bonus points, a motherboard switch can enable the keyboard on a physical designated USB slot to be able to authorize a cert modification. So you get convenience of not having to open the system, or if you want additional security then open the case and remove that jumper.