Isn&#x27;t the solution for Apple to have the phone also sign the firmware update so that the user has to enter their passcode to accept the update and sign the signature of their key.<p>If the firmware isn&#x27;t signed by both keys (the users public key being stored in the secure enclave) then the phone should refuse to boot.<p>That way even if Apple is compelled to sign a rogue firmware, it still requires the user must also be compelled to accept it.