Until now, the greatest concern in this thread has been the fact that what happens when the card is removed.
I propose the following solution (inspired in the GoboSandbox that GoboLinux uses for package installation), that would make the database part of the card, and enable users to swap cards (and not reinstalling when you upgrade the firmware):
1. Don't use ipkg directly to install packages, but a script that wraps calls to ipkg so they're done in a sandbox, to ensure that (1) no part of the root filesystem is touched (2) all files are located in the card, (3) the package database is also in the card, and (4) sync is called after the package installation
2. The script would prepare a tmpfs with the desired structure, with a copy of ipkg and its libs, and several "mount --bind" to specific directories of the card (for /usr/local and for the pkg database), and a mount --bind to the durectory holding the pkg file
3. Then the script would call "chroot /tmp/sandbox /bin/ipkg install ..." to install the package, then do a sync
4. Finally, unmount all the "mount --bind"ed directories and the tmpfs filesystem.
And that would be all.
The copy of ipkg and its libs could be optimized doing a hard link of all the required files to a directory in the rootfs and mount --bind that, then it's only a matter of doing the neccessary symlinks in the tmpfs.
What do you think about it?
The only catch is that users would need to execute once a shell script to install in the rootfs all the needed components (and update er_registry...).
Nevertheless, this is somewhat convoluted, at least compared to the way of packaging programs in simple tarballs (again, please, go to gobolinux website and see how it's done there...
http://www.gobolinux.org ). I speak a lot of gobo, but it's because is one of the two distros I use and know (the other one is Debian).