They could use multiple signing keys. One in America, one in Hong Kong, one in Germany, etc. If a firmware update is not signed in all (or N of M) jurisdictions, the secure enclave simply rejects it.
Of course it doesn't stop any particular government from making it illegal to sell unbackdoorable phones in their country.
[1] http://www.iacr.org/archive/eurocrypt2000/1807/18070209-new....
1. The software that verifies the certificate doesn't need to be changed - which is quite an advantage if it has already been shipped, or if you need to change the signing rules at a later date.
2. The verification logic is exactly the same as if checking a regular, single signature certificate. Nice and simple, no bugs related to whether all criteria have been met by multiple certificates.