It's probably best to avoid the built-in update utilities for the first re-flash. Uboot can load a kernel via TFTP over serial. What you are worried about is b

It's probably best to avoid the built-in update utilities for the first re-flash. Uboot can load a kernel via TFTP over serial. What you are worried about is backdoored firmware. If this is too much work, just buy new kit in sealed packages. Saving a couple hundred bucks just isn't worth the risk.