Secure replaceable verification key architecture in a memory sub-system

A method comprising:

• receiving, at processing device of a memory sub-system, from a host system, a key manifest and a digital signature, the digital signature being generated based on the key manifest using a private key corresponding to a key pair, the key pair comprising the private key and a public key stored in an immutable storage component of the processing device, the key manifest comprising a first verification key;
• verifying the digital signature using a public key of the key pair;
• based on verifying the digital signature, replacing a second verification key stored in a persistent storage component with the first verification key and discarding the second verification key;
• and
• utilizing the second verification key in one or more verification operations based on the key manifest being stored in the persistent memory device.

A memory sub-system comprising:

• a memory component storing a set of key manifest verification keys;
• and
• a processing device, operatively coupled with the memory component, to perform operations comprising:
• receiving, from a host system, a key manifest and a digital signature, the digital signature being generated based on the key manifest using a private key corresponding to a public/private key pair, the key manifest specifying a first key manifest verification key from the set of key manifest verification keys to be revoked;
• verifying the digital signature using a public key of the public/private key pair;
• and
• based on successful verification of the digital signature, revoking the first key manifest verification key, the revoking of the first key manifest verification key comprises updating a revocation map to indicate that the first key manifest verification key has been revoked, the revocation map comprising a set of flags, the updating of the revocation map comprising setting a flag in the set of flags corresponding to the first key manifest verification key.