Ah, thank you for highlighting the relevant parts. That explains a lot. Yifanlu also created a "rescue kernel" before, I think he might have customized the initramfs in that case. The "update*.bin" path sounds great, but as you mentioned, it is blocked by being not affected by the jailbreak, so custom update*.bin files won't work. As you said, the MR_Dev public key would have to be added.
Good thing however is that this reminded me:
- Yifanlu already went through the creation of a custom rescue kernel.
- Such a kernel probably can be loaded via serial interface to uboot.
It's published here:
http://yifan.lu/2011/06/25/one-more-...-for-kindle-3/
Also, Seaniko7 has also created such a kernel (that also has kexec support, which is irrelevant for the problem at hand):
https://www.mobileread.com/forums/sho...75602&langid=2