FPGA and CPLD bootloader
There are a couple of options here.  One is to use a part like an FT2232 where one port is set up as a serial port and the other one is set up as a JTAG interface, then use openocd to rewrite the FPGA config flash or CPLD internal configuration.  I have done this before, and it works extremely well.  You can also put the 'serial port' side in FIFO mode and get a much faster interface (many Mbps) that looks like a serial port from the software side.  This might be the only way to do this for a CPLD as there probably isn't enough logic resources on the CPLD to implement something "in-band", presuming it even has self-programming capability.  

As far as "in-band" updates on an FPGA, you basically have the right idea - rewrite the flash and reset.  Manufacturers usually support some sort of 'golden bit file' fallback technique to enable fallback to a known good configuration if the update fails.  It might be possible to do this automatically, manually via some sort of recovery jumper or switch, or under software control from a GPIO pin on an FTDI chip or similar.  

As far as encryption/obfuscation, unless the config flash is internal to the part or the image can be stored in an encrypted manner in an external flash, I'm not sure there is much point to obfuscation as an unencrypted external flash can be simply read out with an external EEPROM programmer or similar device.  For devices that support loading encrypted configurations, there will be some way to load an encryption key via JTAG or similar which is then either stored permanently or in battery-backed SRAM inside the FPGA.  Then the FPGA will decrypt the bitstream with AES or similar during startup.  In this case, there should be no need to implement any obfuscation or encryption on top of this.