I've found a way that could change CSC. It involves rooting, but with Root de la Vega, so it shouldn't increment Knox. I would root, use bassie1995's CSC changer to change CSC to XEO (http://www.droidviews.com/how-to-cha...galaxy-phones/) and then reflash stock, not-rooted 4.3. However I'm wondering - if root itself doesn't trip Knox and OTAs, will changing CSC do it? Theoretically there isn't any flashing involved - just changing CSC from already-installed multi-CSC.
Phone: LG Nexus 5
Kernel: CM stock
ROM: CyanogenMod 11 nightlies (4.4.2)
Mods: optimized dalvik and bionic, OmniROM File Manager
Previous phones: Nokia 6230 -> Sony Ericsson K700i -> Sony Ericsson K800i -> Original iPhone 8GB -> iPhone 3G 16GB -> iPhone 3GS 16GB -> Samsung Galaxy S II (GT-i9100) -> Samsung Galaxy S III (GT-i9300)

Tablet: ASUS Nexus 7 32GB 3G
Kernel: CM stock
ROM: CyanogenMod 11 nightlies (4.4.2)