Photo of NSA technicians sabotaging Cisco router prior to export

Would it be possible to discover such bootloader tampering using a JTAG port on the board?

Any suggestions for designing tamper-evident hardware, where such attempts could be easily detected?