Armoring a system that will accept only signed updates isn't that hard

Is that true on extremely resource-constrained devices, e.g. the SD cards being discussed?