System time

That would only work if you issue two firmware updates, one for legitimate users before the old key expires to avoid a window where neither key works and one issued after that uses the trick you describe to prevent setting the clock back to the time when the old key was still valid.