Build with MCUBOOT and only provide public key

Hi

We have a third party that develops some of our products, and this third party does not release their source code. However, we would like to sign our binaries with a private key but that would require that MCUBOOT has the corresponding public key for things like FOTA to work if I understand things correctly. Is there a way for them to build their application with only a public key that we provide? We would like to keep this private key... well private and not release to this third party if possible. 

The config 

CONFIG_BOOT_SIGNATURE_KEY_FILE seems to be for private keys
Kind regards
Robert
Related