Digicert surely welcomes this world! I personally don’t expect Digicert to have any real controls at all.

Also, right now, to put malware on a USB stick, you can just write malware to it. To create a USB stick that has malicious firmware to attack the host drivers, you need a USB stick that doesn’t protect its firmware or you need to build your own. In the new world, this changes to, drumroll please, a USB stick that neither protects its firmware nor wipes its key when new firmware is uploaded. Or you can build your own and pay Digicert, or you can attack a machine that doesn’t bother validating the signature because it wants to retain compatibility with the billions of existing unauthenticated USB sticks.

Also, if devices need per-device keys, then I suspect that firmware upload won’t wipe the key, since otherwise firmware upload mostly breaks the security model unless some rather complicated checks on the firmware upload process are done.

USB-C devices are cheap, and they’re made by tons of vendors, many of whom know about voltage conversion but not security. Heck, most of these vendors, even big names like Nintendo, can’t even be bothered to speak the protocol correctly.