Asus has a couple of Wi-Fi access point/switch/router combos with their own Tomato derived firmware named AsusWRT. It's nice. Because it's GPL, the source is required to be available, and a project for a derivative firmware named Merlin exists. Merlin provides additional features. One can choose to flash this firmware if desired.
If these devices must only accept signed firmware then the above becomes practically impossible and you cannot control the software running on your own device.