Ok, so there's something new I wasn't aware of. There's a flag introduced with PR1.2 that gets set to 1 when you boot a unsigned kernel, and won't be cleared until you completely erase the device. Probably done to close yet another of the Aegis bugs.

(They say this flag is stored in the CAL area, and that the CAL partition is now marked read only somehow. Well, no idea how. It was not protected in previous firmware releases because I know of at least one N9 that was bricked by writing to CAL.)

This means that even if you boot the vainilla or any other kernel once, you will be prevented from going back to closed mode until the next reflash

In any case, a reflash is usually necessary to avoid triggering the certificates problem, so no big deal for those that want to "live" using the open mode kernel.

But it is something to consider if you were not planning a reflash...