> vendors are starting to add cryptographic signatures to their firmware

serial console/TFTP/buy from vendors that don't restrict your choice (ubiquiti, netgear, belkin/linksys, some chinavendors come to mind)

RAM is usually fine, just get a decently specced router.