No, the firmware never has any private keys. You sign offline with a private key and provide the public key to the firmware. All further bootloader updates are

No, the firmware never has any private keys. You sign offline with a private key and provide the public key to the firmware. All further bootloader updates are signed with the same key and require no additional firmware configuration.