What to do about CVE numbers

Regular users have no idea about evil maids or rom signature verification, but your argument is that apple should be completely in charge, and I don't think regular users trust apple completely. And it is not necessary to trust only apple to get all those security benefits. Apple could securely let users modify the software on their devices using the same kind of cryptography they currently use to only allow themselves to modify the software.