[U-Boot] Secure update of uboot devices?

[Andreas Bäck]

sha1sum sum is yes enough to verify that no files have been modified on the
file system on the already installed Linux device.

But my case here is if one need to update the software on the device out
somewhere in the world we have now made a usb stick and uboot looks for
special files first on the usb stick before it continues normal boot. How
can one ensure that the software on the usb stick is not altered on the way
to include some additional unwanted features?

I mean a sha1sum on the usb stick one would ofcource also modify at same
time as one add some files to the sub stick. I have been thinking of
public/private keys but then you have the problem that these expires