As written in the grandparent of your post, everything in the Nspire is signed. The first-stage boot1 is not rewritable; the second-stage boot is signed and checked by the boot1; the OS is signed and checked by the boot2.
Signature is done through 1024-bit RSA public keys, we can easily extract all of these keys... but it's not practical to factor them: three-four orders of magnitude more difficult than the state of the art (currently approximately 768 bits), which is itself three-four orders of magnitude more difficult than the 512-bit RSA keys of TI-Z80 and TI-68k calcs that we factored last year.
Therefore, we can't just "destroy the firmware check absolutely" off-line, we have to do it on-calc... and doing so requires exploiting the OS... and finding reliable exploits requires reverse-engineering, fuzzing, etc.