The Supermicro Redfish API is unlocked with the same key, at least that was the case the last time I experimented with it back in 2019.
You can use Redfish, in theory, for bare-metal management of servers. I never went all the way with it, so I don't know how solid the implementation is.
Alternatively you can probably download a free copy of FreeDOS and use that to install the update.
Does FreeDOS boot off a flash drive?
Yes, it does. Booting a FreeDOS flash drive is how I update Supermicro BIOS and flash HBAs with IT mode firmware.
It is possible to boot DOS from USB flash using systlinux.
Why is the private key saved on the rom?
Because that's the only key. HMAC isn't a private-key algorithm.
I think you meant to say HMAC isn't a public key algorithm.
It's a symmetric key algorithm not a public/private key algorithm.