Recovery mode doesn't make mistakes, if it cannot detect the firmware pup on your key as a valid firmware, there are only 2 possibilities:
1. something is wrong with either the key or the file
2. Something was done to the system to induce the issue, for instance the minimum firmware can be changed through various operations like idps spoofing or a bad CoreOS patching.
But it was clearly not the case here, recovery mode detects 4.86 as minimum firmware which seemed normal if the console QA is disabled. You should use the Rebug Toolbox to enable QA straight away & leave it enabled.
If the patch had messed up your console, the validation of ros0 & ros1 after patching would have failed & you would have been notified NOT TO REBOOT because after a reboot you would have had a full brick.
As you can see in this thread, the only consoles having had partial brick issues were nand consoles because on nand the ros region contains ros0 & ros1 BUT also a few bytes indicating the active ROS. Not updating those additional bytes correctly led the system to make a wrong calculation of the minimum installable firmware version & consequently mess with further firmware installation. This bug was fixed in v1.0.23 update.
But such problems cannot happen on NOR simply because the ros region contains no extra bytes, only ros0 & ros1. If ros0 & ros1 pass the hash tests, the patch is guaranteed to be 100% valid.