"To prevent attackers from replacing our firmware with a malicious version, we apply digital signatures."

How about putting a read/write switch on the device that prevents writing to the firmware if the switch is in the off position.