[user0086]

It's signed by the root certificate that is also stored in the car. BMW uses the private key of the signing certificate to sign the FSC files. So the order is as follows:

Root certificate signs signing certificate.
signing certificate signs FSC files.

Car checks if FSC files are signed by signing certificate, and then if signing certificate is signed by the root certificate. This way, BMW doesn't have to use the very secret root key that often (It's probably in a vault and uses a dual custody arrangement), it can just generate a key for the signing certificate and sign it once every few years using the root key.

Basically they have build their own PKI.