Congress could make that illegal if they wanted. They could e.g. make it illegal to sell a device that doesn't accept code updates signed with a particular government key. But they can't do it retroactively.