It's probably best to avoid the built-in update utilities for the first re-flash. Uboot can load a kernel via TFTP over serial.

What you are worried about is backdoored firmware.

If this is too much work, just buy new kit in sealed packages. Saving a couple hundred bucks just isn't worth the risk.