And how long until one of those vendor keys is compromised? Can't exactly revoke the signed key for everyone's hardware. All it takes is a single malicious actor or nasty breach at one of the issuing companies and it's all over.

It doesn't appear to have been a big target thus far, but if we get to the point where companies are perma-banning devices, It's not hard to imagine those becoming target #1 for various blackhat groups.