Ok, so its just possible to use OTA one time after initial writing of sdcard.
After this one OTA update its no more possible.

It might was asked before, but is exchanging kvm_app from remote possible? maybe ssh or so?
I have some picokvms with sdcard where i cannot get access for next 5 years.

Thank you very much for sharing this information
Just for Information, there seems to be an additional issue with signature files:

I have same problem with System Version.
You can update at least App Version to newest 0.1.3 using OTA