We currently support running signed debug/recovery scripts from the recovery disk on boot as an emergency mechanism to recover completely broken systems. The signature is checked against the image update signing key.

It would make sense to be able to use that mechanism without the need for a reboot and extra disk being attached the system, so exposing it through a /debug API route should do the trick.