As noted by @JonathonHall-Purism under #1230 (comment)
Additional improvements - the only suggestion I have would be to potentially just flash modified regions when changing settings - i.e. just flash the CBFS region when that's all that's needed, to avoid reading and verifying the rest of flash. Or even better, to move config, GPG keyring, etc., to their own region, so we could separate them from the payload too. There's no need to tie that to this work though
As noted by @JonathonHall-Purism under #1230 (comment)