Er, Apple kinda have confirmed it. They do so every time they put out an update.
The whole point of signed firmware updates is that the existing firmware will trust them implicitly. Putting down a signed update that does what the FBI wants is easy for Apple. They have the source code and signing keys.
There's fiddly bits and pieces concerning what user input is required to start the installation running, but the user plays no role in deciding whether the update is legitimate and from Apple. And unless Apple has used a mask ROM for the secure enclave on later phones (which seems unlikely - unupgradeable firmware can't be bug fixed), that too could probably be circumvented in a similar way.
Signed updates are used by everything - Windows, Linux, OS X, BlackBerry, etc.
The whole thing is fine so long as Apple or anyone else don't leak their signing keys. Apple are not being asked for those in this court order. They're being asked for a special update that works on this specific iPhone and no other (so it won't work on yours).
Of course if they do leak the keys then there's no defence left. Keeping such keys on an Internet connected computer is asking for trouble.
Unless NSA have got something really good (which I doubt) they can't realistically hack the keys either.
Biting the hand that feeds IT
