It's a trusted computing type lock down AFAIK, so not software update-able. I think they can try the latter of your suggestions, but the same process could just be used to discover the new key, or they'd need to do some serious re-engineering.