We would like to use unique firmware password with the option to rotate the password, in case we have to share the password with the user at some point. Currently that would only possible with moving the device to a group without a firmware password, clear the firmware password and assign the device back to the original group.

Maybe there is a possibility like building a mechanism that sends out multiple commands (one to clear the password and one to set it again), which would effectively "rotate" the firmware password.