If they're going to provide software updates, make it a manual process, like updating the BIOS on a motherboard (not while it's running, need physical access, password protected), with package integrity checks like most Linux distributions have.