Well, i admit it’s getting more and more confusing which we like to avoid in the future with the help of the ‘one version fits all’ approach.
So, in summary:
- There were intially two certificates, a unsecured one which is used by the default firmware and a secure one which is used by the FAW firmware.
- Those individual certificates don’t mix together, you have to create ‘transition version’ that is signed with the certificate that is accepted by the current firmware, but internally uses the other to allow the next upgrade to be signed with the latter.
- Now we are going back to the unsecured one to prevent that kind of mix-up, but for that we need another transition version that reverts the currently in use secure certificate.