If it was, it doesn&#x27;t matter whether the update goes over HTTPS or not: if Mallory The Evil Empire has Alice The Carmaker&#x27;s secret key, neither Bob The Driver nor Charlie The Car have a way of telling them apart.<p>In other words, if a malicious payload is signed with Alice&#x27;s legitimate key, transit security is irrelevant: you&#x27;re getting a malicious payload anyway. Proving that the private key is only in the hands of legitimate user is hard, and proving it&#x27;s being <i>used</i> legitimately borders on the impossible (scenario: Alice signs a malicious update while Mallory holds a gun to her head; how do you find out from the signature? I don&#x27;t think this signature scheme has duress codes). The only thing you can do is revoke the key - but how do you distribute the revocation to the vehicles?<p>However, this still prevents J. Random Crook from walking by your car with a USB stick and an unsigned malicious update (or serving you an unsigned malicious update while you&#x27;re downloading it via his MITMed connection).