Also, my theory why custom content works with download play:
The receiving ds won't accept unsigned data packets, which is why we can't create a Hotspot to spoof download software. However, I don't think the sending ds is just passing already signed software along. I think its encrypting the packets before it sends them with some generic keys. So theoretically we could inject some commands into a modified rom and the ds will encrypt it for us. Basically having use of the keys without having the actual keys. But I could be completely wrong. I'm going to play with it though.