Comment 1 for bug 1371703

I agree it's critical to think about. At the lowest level of the above stack, a shell + system-image-cli + networking should be able to update the device, but it's probably not super easy for the average user. I can imagine a small script that would use adb to shell in and run the update.

If the device's network is down, then I can also imagine that script could optionally push all the data and keyring files obtained in some other way (e.g. via a web site visited on the host). Once the device is attached to USB, this script would push the files into the right place and invoke s-i-cli over adb.