No I understood your point. I just don't think it must be true, in the strong formulation you are using, that there must be a short list of people who can independently cause new code to run on a vehicle. I believe security and access can be set up such that no one person can accomplish that. It may be very difficult to set that up, but it seems worthwhile in this case.