I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted during transfer as the hashes will not match, or if the software or firmware itself was purposely tampered with and modified.
However, What if the software/ firmware and also the digital signature gets purposely modified to suit? The transmitted hash will now match the modified software/firmware. Let's ignore the public and private keys part for now. Won't the hashes will still match on the receiving end and we have a modified software that can still be accepted?