This is worthless, though. If you can replace it, so can a malicious actor. And they can do it without you knowing. Nobody outside of the most extremely paranoi

This is worthless, though. If you can replace it, so can a malicious actor. And they can do it without you knowing. Nobody outside of the most extremely paranoid are going to reflash every single piece of firmware on their devices when they receive them, or periodically. If you physically cannot change the firmware since you don’t possess the keys to actually sign the firmware, then a malicious actor is prevented from modifying it. That’s what you want to prevent. The only other possibility is a one time cryptographic key that you add, that all firmware is signed with… but that means it’s worthless for the average user who won’t do that. Ultimately, the most safe is putting the root of trust in a company (Samsung, Apple, etc) since they can properly guarantee signed firmware. The only potential flaw is a nation state actor that compromises them and their keys (hopefully stored in an HSM). Which is likely easier to harden against than a nation state actor compromising you specifically.