IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied.

It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.