Is it just me or is everyone here deaf? I'm not talking about cracking a current key, I'm talking about the possibility of the boot2 and boot1 allowing for other keys than the current one.

Sorry, my fault. Finally wrapped the mind around the question: the answer is so obvious to me that I never imagined that it's not obvious to everyone.

Here is the part I missed:

My point was that the Boot2 has another option for what key it uses than the default. The question lies in what accomplishes this change. It can't be the boot1, since it's read-only, and it can't be the boot2, since it is the boot2 whose actions change.

Sorry to disappoint you but there are probably just one key in boot1 and boot2 loaders (unless someone did huge mistake while building them). And the to change it you indeed must change boot1. And indeed it can only be done on factory which build these things.

The message about "Production Keys" is not for end user - it's for service center. If the Nspire does not say these messages then most probably someone took MB from prototype and put it in regular Nspire: service center is not supposed to repair such devices.

WTF? Who will need all this crap? Well, the hardware is not developed in a day, you know. And original TI-Nspire hardware was different from what you can buy today in stores. Take a look. These prototype devices are sold on ebay from time to time (there are couple of them right now) - and since they require different signature they are sold for cheap: you can not install a production OS on them (different key prevents it and even if you'll manage to overcome this limitation it still will not work because hardware is different). I don't know how boot log looks on these devices, but most likely it does not say "Using Production Keys".

Since this approach is pretty typical in hardware development I was sure it was discussed to death already... but now looking back I see that indeed it was never explicitly explained... at least not in this thread.

As for breaking the key...

So how hard would it actually be? Would it involve doing 2^256 trials, or is there a faster way?

Well, the fastest known way involves 2^253.5 trials which still makes it totally impossible. Better to find some other kind of weakness... perhaps something similar to what Nintendo did (they used strncmp to compare sha1sums so the attack become 2^8 trials, not 2^70+ trials).

Yeah, I wonder why it picked 2004. Maybe it got confused with one of the early version of the site

Well, it found lots of different dates on page and needed to determine which one is the correct one. One date in particular was mentioned lots of times: Aug 12th 2004. Five times here, four times here. And it precedes other dates. Obviously it's the date of document creation! Check the pages yourself: the "Aug 12th 2004" is still there - and in many copies, too!