You won't need new keys in that scenario. The binaries are signed with a key that's chained back to the trusted key. If the signing key somehow leaks (and really that is not a terribly likely thing to happen) then that key can be invalidated and a new signing key produced that chains back to the same trusted key. Binaries signed with the new key will continue to be trusted by existing firmware.