Signed firmware packages won't cause that. They change the keys on both sides to stop it from doing it. But if either side doesn't match, it won't boot all the way. Which is why kexec works for us, but required allot of workarounds and system trickery to boot. But it does. It's not easy to recreate without a computer tho.