So a secure boot process starts with a hardware based chain of trust. The root public key is baked into the ROM which is used to verify the low level boot loader which in turn boots the kernel. With this implemented, a software update will then be signed with the same key used to verify the kernel.
Are there any advantages if the key used to sign the kernel+system is different from the one used to sign the low level boot loader?