There's also an exploit in the USB stack of the boot ROM involved, so it's not quite "using it as intended". I'd argue ntrboot on 3DS is much closer to what you

There's also an exploit in the USB stack of the boot ROM involved, so it's not quite "using it as intended". I'd argue ntrboot on 3DS is much closer to what you're suggesting, using a built-in repair access mechanism dependent on long(er) broken crypto.