Hi Florian, thank you for showing such detailed interest in our approach, we really appreciate that!

As we lock the chips after the first provisioning and attesting on the blockchain this is not a real issue.

Even if creating new key pairs would be possible, without the corresponding blockchain entry these additional key pairs would not help you achieve anything.