Part of the problem is that Atmel are clearly not going to tell you what the authentication prococol for the command and responce verification actually is unless you sign a non_disclosure aggrement with them as it uses a proprietry system.This is not a good sign as there are many well known verfication protocols already in the public domain so you have to ask why they use this particular system.One of the first rules of cryptography is dont trust an algorym where they wont show it to you until you pay lots of money,because it might be a sign that its not very secure.Most people who are sure that there system is secure dont care who sees it.