Ah, so for example challenge-response/public key? The first stage knows the second stage’s public key, and can verify that it knows the private key.

That would make it less secure ("only" as secure as the private key), which is the trade-off the developer made in exchange for an upgradable app, correct?