Can a Kinetis mcu reset itself to boot from protected flash in order to start a bootloader (for a firmware upgrade) or does that need to be initiated by a hardware reset?
That depends if you need to reset the registers/peripherals to the power-on reset.
Something I used to do is to let the watchdog timer to expire: this will perform a CPU reset.