Then your comment doesn't make sense?
You wrote:
> completely insecure if you are not the only one with the key
What key is shared between you and the manufacturer here? There's signing keys and there's passcodes, which ones are you "not the only one with"?