For PUPs we dont, but i thought for pkgs we have. I know we cannot sign PUPs to install on 3.55+ I'm talking about a gameupdate for example: COD-MW3.
We can sign the 1.23 gameupdate pkg with later keys to use in 4.xx CFWs or DEX-OFW, but on CEX-OFW we cannot install this pkg.
But if COD wants to connect to internet, it IS downloading and installing this pkg from their servers. If we map the URL of that pkg to a modified pkg on a local computer, an OFW would download and install that modified pkg.
And If you start that game on OFW it will run the EBOOT.BIN of the installed update... So if the modified EBOOT.BIN only uses sys-calls available in OFW we might execute user code on OFW...
ConsoleDev, i know that you have a lot of experience and knowledge, so if you tell me this way wont lead to something, I trust you, just wanted to make sure, that you know that I talk about gameupdates and not PUPs.