Tomorrow, I will look into this more closely, but my research got me into this:
Once we unpack the .PKG from the FTP server, we get a PARAM.SFO, a .PNG and a folder named USRDIR with a EBOOT.BIN. With one of the released PS3 GUI TOOLBOX versions, we could unpack this EBOOT.BIN and get a EBOOT.SELF. This .SELF is of grave importance for signing keys, I think. We have to sign them SOMEHOW into the .SELF to make them look like Sony's own application.
After we've done that, we have to reverse the entire process: repack the .SELF into the EBOOT.BIN, replace the modified EBOOT.BIN with the old EBOOT.BIN, repack the .PKG and upload in onto the PS3.
This would most likely work, I think. Main problem: where to sign the keys into the .SELF?