The private signing key can and should be stored only offline. It&#x27;s presumably only used when new OS updates need to be signed, and as a result it&#x27;s fine to require manual intervention during that process.<p>By contrast, putting a device with the modified firmware on the network and allowing it to be accessed remotely makes it a much easier target than the private signing key. A compromise still isn&#x27;t likely, mind you, but that&#x27;s a pretty damn attractive target.