We also literally just had the Windows key leaks within the last week. Un-updatable signing keys are still an uncloseable exploit vector. (And updatable signing keys are an uncloseable exploit vector. You can't win.)

Physical-access-only updates: yes please. We know what the security boundary is on those, and how to reset it.