This isn't possible. The docs[1] state once revoke_devkey has been set, you can't upgrade to a bootloader not supporting secure-boot and downgrading is disabled.

[1] https://github.com/raspberrypi/usbboot/blob/master/secure-bo...

I think that's what program_pubkey[1] is preventing. While you could still flash other EEPROMs, their then mandatory public key would not match the hash written to the OTP.

[1] https://www.raspberrypi.com/documentation/computers/raspberr...