1) The keys we need are used to decrypt the first section of the metadata that houses a key.
2) That key is used to decrypt the rest of the metadata which houses a bunch of keys and headers for the encrypted sections of the file.
3) Each header tells the loader which key in the list goes with what section. Not every key is used. Usually most aren't used (something like 3x the amount of keys that are actually used).
So now the problem is if you had a 3.55 self that was only re-encrypted, not changed, and signed for 3.6+, the only plaintext you could use is the decrypted sections from the last step. The keys are all generated when signing the self so the encrypted first key, headers, and key list are all different. Now you may be able to find each key associated with the sections from the last step, but you don't know where the key should go in the list as you don't have the decrypted headers telling you which key it is. So those keys couldn't be used as plain text to attack section two. You'd need to be able to attack section two to get the plaintext for one. With that plain text, you could attack to get the loader key.
Just my two cents :P