well, no one really knows how the security works. The hackers are claiming that they can make a *.pup file. If the decrypter/encrypter code is from Sony's updateable pup itself, then sony can recover via whitelisting of old binaries and using new keys for new binaries. If the code for the encrypter is not updateable, and actually inside the CELL itself (like the on die boot rom), then sony is screwed. I think it is the former and not the latter. But who knows whats going on in the firmware team's mind.
The whitelist is a nasty horrible means of dealing with this if it needs to include game binaries. Whenever any game has an update or patch the whitelist will need to be updated. That is not a suitable solution in my view.