Hopefully, he also patched some portion of the bug that let him rewrite the bootloader signature verification code... or someone else only has to look at your u

Hopefully, he also patched some portion of the bug that let him rewrite the bootloader signature verification code... or someone else only has to look at your update to have their own keys to the kingdom. One should also be sure that the signature verification is not based on simply an obscured symmetric key that easily allows key extraction and any code to be rewritten to those devices in the future once it is extracted. One assumes from his solution this isn't the case (or he'd only need one sample to get the key). You don't HAVE to do public/private keys, but it's the most convenient.