Sure, but what code is the sd card running? All sd cards have drm protection (which interestingly, hasn't been cracked) and memory that isn't user accessible (see wikipedia), as part of the standard. And they are riddled with security vulnerabilities that allow remote code execution on them ( see http://www.bunniestudios.com/blog/?p=3554).

I mean that's a level of paranoia I usually don't hold to, but if you are going to go all out, I have to wonder if there is a more secure form of non volatile memory.

Those instructions don't load any proprietary binary blobs - the boot loader is an unmodified official release of u-boot that you can compile yourself. The only things you need blobs for on this era of Allwinner hardware are 3D acceleration and hardware video decode/encode.

author here: No, I'm using no blobs; just the mainline Kernel and U-Boot. All the software stack is leveraged on Debian.

Verify package signatures via air-gapped machine prior to install, they did mention downloading to usb using another machine.