How to enforce data privacy, integrity and authenticity of distributed firmware images for an embedded device?
First, if you mean to sign something, you should use a signature algorithm, rather than "RSA encryption" with private key, which on its own may be very weak.

Now the main issue here is that the RSA part is only authenticating the nonce. Anyone who knows the AES key can just encrypt an arbitrary firmware image with a nonce they've already seen. This allows them to reuse the earlier signature. So there's no guarantee of authenticity if the AES key is compromised.

To fix this you could sign the whole encrypted image – nonce, authentication tag and all. With a strong signature algorithm (e.g. RSASSA-PSS) using a strong hash function, there is no way even knowing the AES key to encrypt another image with the same signature.