Why is it a problem that the firmware binaries are signed by Microsoft? If you can insert your own key as a trusted key, couldn't you just discard the Microsoft signature and sign the firmware blobs yourself with the key whose public half you have added?