Yes. Xilinx chips can do on-the-fly reconfiguration. So you can have your bootstrap loader and then either load a more complete firmware from the spi chip, or over pcie
When I looked at the encryption format for the virtex 5 series it was quicker to reverse engineer it than it was to find someone within Xilinx that could explain it (just basic bit/byte order, what's covered by encryption, etc).
At the end of the day, FPGA configuration logic is just another state machine ;)
The easier thing to do would be to delay enumeration.