If you have the network infrastructure to support it, you could indeed distribute a Debian type network installer that can complete the build process for each appliance on it's own, getting all of the required components off the network. We could use something like TKLBAM to do it.

It's something to consider for the future I suppose, but it would be a pretty radical departure from our current way of doing things. Many things would have to change simultaneously (e.g., the website structure, the documentation). So before it would get better, it would get worse. Also, I'm not sure it would be worth it. Building and distributing the images only takes a few days. The bottleneck is the integration and testing, which is labor intensive. Going down the 1-click installer road may require more testing, not less, as there are more elements involved and more things that can go wrong.

Also, coming from a security background myself I would be suspicious of a distribution that assembles itself from over the network and can change at any time. It's harder to understand, there is no audit trail, etc. There's a trust issue here. With the way we are doing things right now, a signed release implies responsibility. Our reputation is at stake.

While on face value it sounds like a nice idea, I think it would add to the complexity and IMO that is generally a bad thing, more room for problems.

And also I don't think it really adds a lot of value to the end user so unless there was a clear labour saving then I don't see any real advantage.