You need the keys to sign firmware - would you expect customers to write firmware?

I expect customers to sign custom firmware that they download. Some advanced users will write their own.

To address the point about companies also needing to deploy firmware — you can have two keys on the device:

1. For company firmware.

2. Included key with the device.

This is a key for company firmware, so the second point has nothing to do with it, except the easier it is for a user to write their own firmware, the easier it is for malicious actors to do the same.

This is exactly the reasoning behind Purism: https://news.ycombinator.com/item?id=24463347.