Then it would become similar to bluetooth pairing or something.

Hold a specific key while booting an install medium, get some confirmation onscreen that you actually want to change vendors (it even might empty the list of keys)

And for extra security show a visual representation of the active key while booting so that the user will notice an unwanted change (It should not be to hard to generate a visually recognisable image from the key. A kind of visual hash.)