It's not that reverse engineering is difficult - the FBI could theoretically do that now. It's that it needs to be signed to be accepted by the phone.

Edit: see, for example, here: https://stratechery.com/2016/apple-versus-the-fbi-understand...