When is a Firmware Update decypted?

Or is it?

With OtherOS++ could we run the update manager to start the Update to 3.6x and when its decompressed have it stop before install copy to another LPAR from flash memory (or even have it decompress directly to another location) and be decrypted to view??

It is stored in plain view in dev_hdd1

.

it's never decrypted while installation, it doesn't need to be.