Nintendo, being Nintendo, has access to Nintendo's private keys and whatnot. As far as we can tell, they used these keys to make a special boot1 image that passes the sigchecks (since it's signed by Nintendo) which they then flash onto an SD card. From there, some fancy tomfoolery with factory hardware and maybe the CMOS battery makes boot0 read that SD card (with process has been named "MCP Recovery") and then Nintendo's recovery environment runs.