Unfortunately, this has the usual downside that end users no longer control their own devices. For example, dd-wrt/OpenWRT would become impossible, and even "open source" firmware would be basically meaningless since no one could use your changes.

One way around this might be to have the device accept two keys – a manufacturer key that is common to every device, and then a user key that is unique to the individual device and whose private key is provided to the user. This would add to cost and complexity, though.

Alternatively, provide some physical means (a jumper, e.g.) by which firmware verification can be temporarily disabled. The downside of this option is that you can't do automated firmware upgrades any more, which makes it more likely you have vulnerable devices in the field for long periods of time.

There seems to be a fundamental tension between allowing users control and keeping them safe, which Alex Stamos recently termed "security paternalism". We see this come up in walled garden app stores vs. allowing users to install anything they want, in making SSL problems "warnings" vs "errors", and so on.

I think it would be an amazing advance in computer security research if we could find a way to provide both at once.