I think there are a lot of conflating issues in this discussion.<p>Firmware signing and how updates are delivered are one thing. I would argue that having only one possible adversary is preferable to everyone being able to create firmware that runs on your device. If there&#x27;s a practical and secure approach that would allow users to install only firmware updates they approve of, I&#x27;d be all for that[1]. In the end - please correct me if I&#x27;m wrong - this would require a user-generated key or passphrase of some sort, and then we&#x27;re back at a brute-force problem and the question of how secure is that passphrase and how are rate-limits enforced.<p>The iPhone&#x27;s disc encryption, however, does not rely on this so-called master key. That&#x27;s why I think calling this a backdoor isn&#x27;t a fair assessment. It&#x27;s entirely reliant on the complexity of your passphrase. The iPhone&#x27;s security architecture, including the firmware signing and in newer versions the secure enclave, make attacks against this significantly harder (or next to impossible, if the secure enclave firmware is actually read-only ... something that definitely needs to be clarified). Compare this to your typical desktop full-disk encryption, where you usually have no countermeasures whatsoever against this kind of thing.<p>[1]: Speaking as a developer. I&#x27;m not qualified to answer this for sure, but my gut feeling is that such a feature in the hands of typical end-users might actually be a bad thing for security.