Multiple vector tables. Just 2 - the usual one, located in the last page of flash, and another in the redirected location (above protected flash).
At reset, NVOPT is loaded to FOPT, which determines which vector table is used. This gives the choice, as we have now, whether you redirect or not. Then be able to change FOPT later on, so that a bootloader can pass control, and vectors, to the application firmware.
Not being able to redirect the reset vector is OK.
The process would be:
1) start the bootloader (normal vectors)
2) bootloader decides if it should run the application firmware (check for pin state, serial message, and/or vectors != FFFF)
3) to run the application:
i) disable interrupts
ii) enable vector redirection
iii) JMP to application _Startup or main
The advantage of this is that a bootloader could use it's own set of interrupts. not at the same time, of course.
The only change in silicon is to allow the FNORED bit in FOPT to be writeable. Maybe just allow a write from 1 to 0, and then require a reset to change back to 1.