You cannot reset the Knox counter once it has been tripped I am afraid, otherwise it would be pointless as a security feature. In fact, there has been a reward of over, currently, $3,000 for the last year for anyone who can successfully reset it. See, here.

You are right, both towelroot and CF-Root will not trip Knox or affect your ability to update usually. However, a custom recovery or a custom ROM will trip Knox and prevent updates via Kies and OTA, normally.

If you wish to update to a stock Samsung firmware, you can do so by downloading it from, say, SamMobile and flashing it via Odin. The Samsung stock firmware contains a stock kernel which will unroot you and you will need to re-root again.

For more information on Knox, see, Knox Security & locked bootloader on new firmwares

 

The Knox warranty has nothing to do with the phone's warranty and serves only to show whether a phone's security is intact. The statement from Samsung in #1.11 of Knox Security & locked bootloader on new firmwares explains and confirms this. Everyone had better get used to Knox Security as Google, not just Samsung, have now adopted it for all firmwares from Android 5 onwards.