Totally not possible due to plenty of checks. If it was this easy, literally every system out right now would be hacked to bits.
NUS emulation is going to be impossible due to SSL, probably. Network traffic isn't encrypted with the common key... Even if you could, the updater probably does checks to the version title to make sure it's older than the one specified in the update manifest. Aaaaand actually that being said, you probably can't create your own update manifest, either. There's no reason update manifests wouldn't be RSA secured.
Oh you're so right, SSL.
Technically you could break it (mitm + forging a signature). But if they use TLS then the dream ended right here