Firmware distribution console.
This server never holds a signing key. It verifies every firmware package against a pinned public key and cannot introduce unsigned code.