The PSoC 3 (and 5) has the ability to act as an USB - Slave, just like your USB-Key. Your key, as I understand, must be connected to an USB-host. Bootloader can be used with different interfaces: USBUART, I2C,UART and you may even write your own interface to upload to PSoC a new bootloadable.
Bootloader (BL) is a general concept, you can write a BL that will boot over
almost any connection, an A/D for example (that would be pretty sillly) , any
com interface PSOC can support. At its root a BL is nothing more than a kernal
sized piece of code that can detect a boot request and operate some interface
to get the new binary or script or interpreter that you want to burn into part or run
from device RAM.
You can customize your Bootloader to accept a particular KEY from the USB host for verification before Bootloading your device with a new Application program.