There was a time when RDRAND on Zen gave all zeroes, or something, so eh...

I'm happy enough with TLS introduced: knowing the server I'm reaching for updates is actually 'amd.com'. Signatures would be nice, sure, but I wouldn't consider them nearly as critical or useful until now. Before we get too caught up in signatures, however, I'd like to see their new/improved updater actually take precedence.

As things stand, I'm not sure key rotation would go well... the updater doesn't mind itself, apparently.

Those have been broken again and again. Even if not, how do you distribute the public keys for it, how do you bootstrap that trust?

AMD Software Engineers giving AMD Stupid Gaming Accessory Software Engineers access to a signing system backed by PSP seems like a much worse outcome than trusting HTTPS, really. Like, there are definitely intelligent and secure ways to do this, but this one in particular is overkill with a huge blast radius when it is (invariably) done incorrectly.