If you're familiar with how Android recovery works, I believe that that's how Gateway downgrader works. The Gateway downgrader sits between the system and the nand (probably the ram or SD card) and basically erases all files from the nand (which is fine because the gateway downgrader isn't running from the nand). It then copies the older firmware byte for bye to the nand, thus making the nand into a 1:1 copy of an older firmware installation. The whole process is very similar to nand dumping and restoring, so no signing trickery involved.