System updaters are really just glorified CIA installers. Given that all CIA files in update packs are legit, you can install them without sig patches using only arm11 kernel.
Your question asked "how is it possible without arm11?" It is worth pointing out that we have an arm11 kernel exploit on up to 10.7