Field upgrades:

Often you can use a production unit (assuming its a small microcontroller box) and add batteries and a com cable and ship it to the customer for temporary use to upgrade the unit. He can hook it up, let the two micros chat a while and if they trust one another... exchange the goods.

Before we started using Palms for upgrades, we took our unit, placed it in a case cut for extra depth for lithium batteries and shipped that out for upgrading in the field. If they returned the unit, they got their deposit back.
That beat designing a field upgrade board and allowed us to completely control the communications exchange so that no one with hypercom could blackbox it for secrets.

Always scramble your payload too - so they can't steal your code from the upgrade platform. We use a unique encoding string in each unit sold; that means we have the burden of saving and protecting those records. That meant we upgrade package only works when descrambled by that targeted unit.

*see old message on data safes.

duh :)