I'm not familiar with the PS3's architecture, but it seems that any firmware update that includes new keys will... have to include the new keys. Since the update includes the new keys, and the old keys decrypt the update, the old keys can be used to obtain the new keys. Corrections welcome.