Not necessarily. All they have to do is roll a pub key into the update package. Same as any OTA update.