In Secure Boot (here defined as data is encrypted and authenticated), we can encrypt the data with AES-128 and authenticate it with a RSA signature, computed over the data's hash, afterwards.
On boot, the device first calculates the hash of the encrypted data, verifies it with the given signature, decrypts the data, and starts executing. However, calculating the hash and verifying the signature is kind of expensive in case of time and resources, especially for embedded devices.
Proposal: My idea is to replace AES and RSA signature with AES-GCM to speedup the overall boot time. Using AES-GCM, we achieve the same security goals confidentiality and authenticity. The used AES key is stored securely on the device in a HSM (Hardware Security Module).
Drawback: I am aware of the fact that I loose the advantage of not having the private key on the device to generate a valid signature. In case of key compromise an attacker can read the data but cannot authenticate new data. Using AES-GCM a key compromise means that the attacker can not only read the stored data, but also authenticate it meaning he is able to execute his own data and fully take over the device.
Question: So besides the discusses drawback, would you consider this a valid approach? Or is there any reason for not using AES-GCM that I overlook?
Edit: Added more details to the description.
Just to clarify this. I am not talking about updating the data to be executed. In the described situation the data is already on the device (how the data is put initially onto the device is not relevant here).