Storing a Secure Boot image with AES-GCM instead of AES + RSA signature
Yes, if you already have a shared symmetric key then this would be something to consider.

Note the following:


you do not need to store a private key in the embedded systems in your previous scheme;
the security of the key generating the signature is probably more important than the key providing confidentiality of the update (updates are often not encrypted - at least for many software packages out there);
related with the previous topic, keeping a private key secure at a central location is more secure than distributing the symmetric key (even if it is placed in a HSM);
the access to the HSM is paramount in this scheme, if the software contains all the data to use the key in a HSM, then one hacked embedded device is still enough to compromise the security - you probably need to encrypt / "sign" for each device with separate keys if you use just AES-GCM.


That's just out of the top of my head - there are very likely more points to consider.