To quote from the ReadMe/Twitter: btw if you don't want to mess with the whole packages algo stuff, just use AES CTR with the package key iv at 0x70 in the package. Sorry I forgot to include the readme in the fixed release, this is now fixed as well. btw that hmac key was fail, don't use it, another is actually used.
It's not really signed, just encrypted with AES and HMAC. woops I forgot to enable the button when I cleaned up the app (yeah I fail, gonna do a small re-release xD) btw I forgot to mention in the readme this is not the 1:1 algorithm, it's been improved, it extracts pkgs roughly 3 times as fast as on ps3.