i note in passing that the openmoko GTA02 sidestepped the problem neatly by having *two* boot loaders. one is fully-writeable, gets upgraded from time to time, and this is the one that normally boots from cold to start the OS; the other is read-only but can be used to reflash either the OS or the writeable boot loader.