Loading and using encrypted firmware usually requires one of the following conditions to be met:
You have a security (co-)processor and the processor is trusted to
follow the instructions given by that (co-)processor
You have a trusted processor and some tamper-resistant storage
You have a security (co-)processor and the processor is trusted to listen to this coprocessor.
You now also have a firmware image, signed by the manufacturer and symmetrically encrypted using a key hard-coded in the coprocessor. The co-processor will now load, decrypt and verify the image by itself and then pass it on to the processor.
Note that the coprocessor is designed to be tamper-resistant and thus extracting the secret symmetric key or changing the public manufacturer key is impossible.
In this case you trust your processor to do what it is supposed to do and also have some tamper-resistant storage.
This time, you store your bootloader unencrypted in the tamper-resistant storage which will prevent its exfiltration or manipulation and thus you can just hard-code the secret key needed to load and verify the firmware into the bootloader.