If you're going to risk this, and if Nintendo doesn't store header or cert information immediately on cartridge detection in some log file that is sent back, it would probably be best to "insert" the cart in SX OS, power down and boot up an exclusive nx-dreport hekate config, power down and boot normally into the regular OS without any modifications. Using any modifications at all is probably not a good idea. Hopefully they don't store the info on a cart and push it out automatically on connection.
This is the way I plan on doing it, but I'm only concerned about eShop games, and I know we'll have an installer for that sooner or later. I'll report back if I get banned. I don't plan on ever playing my dumps, or downloaded dumps online though, so I won't notice that ban either way.