I will state that all things (this is stated liberally, I am sure that I am wrong in certain cases) that has to do with hardware can be discerned/extracted using software. Even if it means writing your own OS to do it. With the rampant presence of Virii on the Net today, who is to say that someone can't grab your private key from the hardware and send it to Joe Schmoe's email address?? Even if it couldn't be reached in this fashion, anyone with access to the computer you use could access your key (unlike PGP where a password is required).
Uhh, the same way that people do it today with software encryption products (like PGP). Just pass out your new public key and stop using the old key pair.
I grant this, and have misstated my objection. What I meant to say was how could those people downstream know that this is a legit new key, and not one that someone bogusly generated to pretend to be you. Plus, being able to replace your key would imply a software interface to modify the hardware, which would make the system intrinsically insecure.
You assume that this chip can be "upgraded". It's quite likely that this chip is entirely hardware-based. No "flash" upgrade at all. That would leave it open to the attack you mentioned. The whole idea is to keep the chip completely isolated from software.
I don't know of a method to keep a chip completely isolated from software. There must be some software interface or the hardware couldn't talk with the servers to perform the encryption. Plus as stated above, you can always access hardware from software (again being liberal).