> …sign tampered with firmware that would allow the decryption without user authorization.
Apple wrote the firmware for everything. I assume they could write firmware to not need authorization, embedded in a copy of iOS, and sign everything so it could be installed on a phone through DFU.
They have been unwilling to do so. I think they’re right not to. But I suspect it is technically possible.