There is indeed a revocation system: software is able to add blacklist entries, which may be a hash of a binary, or a key (revoking access to all binaries relying on that key).
However, updating the revocation lists requires your updates to be signed with a key that is already present in firmware.