Hallo,
I also try to get real ssh on my VTO2311R.
So far i dumped the nand of my target, just in case...
From my xp so far, I can say, it seems to be impossible. Even the IPL/SPL/U-Boot has a signature. Tried to build my own u-boot based on openipc files from github, but after SPL the error...