I did some googling on the renaming of otacerts.zip and I got very concerned. There are some who claim that renaming this file won't stop the OTA downloads from happening. Instead, matters get worse, because the validation of the download file fails without the otacerts.zip file, and the system goes into a download loop trying to get the file and failing to validate it repeatedly. I don't know if it's true, but it kind of makes sense.
I'm still stumped as to what mechanism Froyo uses to notify users of an OTA update. The old OTAUpdate.apk is not there as it was in Android 2.1, so obviously can't be deleted. Once I got my own OTA notification, I did a "ps" (yes I am rooted) and didn't see any obvious entry that would indicate which process was generating that notification.
Obviously the guys writing the custom ROMs know what to delete, because those ROMs have OTA updates disabled.