To all you MSO1000Z Owners: It's done, we found what Rigol changed for the MSO1k and we patched rigup to generate working keys.
Another successful hack here on a MSO1104Z. I used a JTAG interface I had from a Luminary Micro (now TI) ARM eval board. The dump took around 56 minutes as I didn't try anything to speed it up, but I got rigup compiled under Ubuntu during that time. No problems at all. I just couldn't telnet to it like someone has suggested, so entering the keys were a bit tedious.
While I had the scope open I noticed the cover on the metal can was not all the way down on one corner because a tab was stuck inside instead of on the outside, so I fixed that. One other suggestion for anyone doing this: Be careful of the power button. Mine got scratched slightly (very slightly, hard to see even if you know it), so take care when pulling it apart and reassembling. The switch goes through a hole in sheet metal, so the edges are sharp.
I also removed the sticker using a heat gun and label backing. Very slick. I won't bother reapplying, but am keeping it stuck on label backing just in case.
Thanks also to those (especially smgvbest) for pictures and exact instructions, and of course those who came up with the hack.
I don't know how some of you figure this stuff out. I develop embedded systems, but reverse engineering crypto seems difficult to me. At any rate, thanks a bunch.