Was just writing my reply when you sent yours.

With this, there would have to be a closed and immutable boot code of the secure element, otherwise the rest could be mostly open, allowing stronger firmware verification.

Insider attack protection would be implemented as system-controlled flag that decides whether data transfer is allowed across applet upgrades. This could require the owner to authenticate, so it would fulfill that requirement.

Requiring the KeyStore applet be signed by a trusted party + issuing an attestation certificate to it would also tick that box.