There appear to be on-board PPP configurations for both Sprint and AT&T (though of course the Kindle's EVDO modem will only talk to Sprint).
As indicated by a previous anonymous commenter, it's not actually that hard to turn on the 3G modem while USB networking is on.
Sorry, kids. It's my sad duty to report that Amazon and Lab126 are neither inept nor stupid. You can't get much of anywhere except for Amazon or their web proxies. Your dreams of a magic, free internet dongle the size of a paperback book that works anywhere in the US will have to wait.
One slightly terrifying thing I noted in the NetFront configuration file on the Kindle 2 - All traffic is proxied through fints-g7g.amazon.com, Amazon's Kindle web proxy. HTTP and HTTPS alike are proxied on port 80. Amazon can see what you're downloading, even if you "use SSL." (As could anybody who could sniff your EVDO traffic, but I'm told that's something that's only easy if the attacker is running MovieOS). I know there are solid technical reasons for this decision on Amazon's part. It doesn't exactly make me comfortable.
What else did I discover during my week away? This is a rough first pass at a list.
There's code infrastructure for iphone-esque orientation switching, though I'm not seeing anything that suggests that the backend for that exists...yet.
Building an entire GCC toolchain that can run natively on the Kindle (don't ask why just yet) is a real pain in the ass, but thanks to the Fedora ARM nfs-root instructions, the Ubuntu ARM root filesystem and crosstool-ng, I think I may have something stable and reproducible soon.
I'd previously cross-compiled gcc, binutils, glibc and coreutils by-hand, but it's turned out not so stable. Getting somewhat desperate before I managed to find the right incantation to overcome Q-emu/ARM's weird SCSI lockup problems, I actually got enough of a dev environment up on my N810 to build an ARM-native Perl linked against the ~right glibc such that it runs ok on the Kindle.