I've created imageupdate using release 0.2.18-r5 and it worked...
So if i understand correctly.
When I'm receiving imageupdate from tftp/multicast it can be signed by STB_PUBLIC, but after that when updating via http/usb updated imageupdate must be also signed by STB_PUBLIC.
But, when image via tftp/multicast is signed by my custom key, new imageupdate (via http/usb) must be signed with that same key (my custom key) and no other.
So I can change key only when using tftp/multicast, right?