Now we can decrypt SPRX/SELF files, can't we get the HMAC key used to verify PUPs?
The patched 3.41 PUP uses different HMAC-SHA1 hashes, so the PSJB team must of found the HMAC key in order to make those hashes. That means those hashes must be important for custom PUP files.
AFAIK PUP files are handled by software_updater_plugin.sprx, surely the key would be inside there?
(looking for somebody more knowledgeable about this to pitch in here and tell me if i'm heading the right way :))