Hi stefan,
Yes, you can use BOSSA for that.
For other people interested in doing that into their own code: you have to use the EEFC by sending a Set GPNVM bit command to set the GPNVM0 bit.
This will make the flash not readable from any external way and totally lock the JTAG/SWD debug functions.
The EEFC peripheral driver isn't yet available in the public GIT.
The only way to come back to a fully available SAM3X device is to process a chip erase using the ERASE pin through the atmegau serial protocol or the ERASE button on the board. The board needs to be powered for this.