I managed to figure out how to do field firmware updates over USB. Here's the process:

1. Fetch the micro SAM-BA source from GitHub. Compile it. It should work fine on Linux or MacOS X.
2. Short the erase jumper and plug in a USB cable to apply power. Unplug the cable and unshort the erase jumper. Plug the USB cable back in.
3. The three LEDs may be glowing very faintly at this point (the default GPIO config is pulled-up). You should see a CDC device (a virtual serial port). Take note of the device name.
4. Run these commands (setting GPNVM bit 0 is the "security" bit that will lock out all debug interfaces - do it only as an absolute last step or you will have to re-erase the chip and start over):

   usamba [port] write Orthrus.bin 0
   usamba [port] gpnvm set 1
   usamba [port] gpnvm clear 8
   usamba [port] gpnvm clear 7 
   usamba [port] gpnvm set 0

5. Unplug and re-plug the USB cable. You should see Orthrus running the new firmware.

Note that because of this, it is imperative that you insure that access to the ERASE jumper is prevented to insure that rogue firmware cannot be loaded. The best way to do this is to embed Orthrus in a case to which you can apply tamper-evident seals.