Congrats on successfully getting the government to step in!

Depending on the nature of your product and your supply chain, you could try to only flash the firmware once the finished products arrive in America (assuming the packaging isn't sealed yet). And do your best to make it hard to completely dump the firmware (maybe make part of it encrypted with a key that's in a one-time programmable memory that can't be read except by the decrypter, if one of your chips has this feature).