It's likely that system vendors will sign their firmware updates with a different key to that used to sign anything else, yup.