Updates for a private plugin? in WordPress

Looks like the applicable code is in wp-includes/update.php , wp_update_plugins() :

$to_send = (object) compact('plugins', 'active');
$options = array( imeout' =>
 ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3), 'body' =>
 array( 'plugins' =>
 serialize( $to_send ) ), 'user-agent' =>
 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
);
$raw_response = wp_remote_post('http://api.wordpress.org/plugins/update-check/1.0/', $options);

It specifically checks api.wordpress.org. Technically speaking it would be possible to pass a key inside $to_send to delegate the check, but to my knowledge that ist a supported feature.

If you hook into set_site_transient_update_plugins you could add your own package details into this variable. It looks like those values will be trusted when you run the plugin updater. See wp-admin/update.php and wp-admin/includes/class-wp-upgrader.php . Given the code in these two functions, I think it would be possible to inject your own update server, you just need to look at how the package details are formatted and match that.