Rotating Embedded Firmware Signing Keys: Test the Trust-Overlap Window Before Revocation
Retire a firmware signing key only after every supported boot and recovery path can authenticate an approved replacement image without that key. For a planned rotation, an explicitly qualified overlap state can let devices accept both the old and new signer while the fleet migrates. That overlap is a product-specific trust policy, not a universal…