I heard in RCM mode you can essentially do whatever you want to the system. Doesn't that include flashing unsigned backups? Would you not be able to patch signiture patches to OFW to run homebrew or at least flash the nsp into the NAND backup? Sorry for the late reply.