Originally Posted by ixtab
That's exactly what I wanted to verify. Because I dimly remembered the keys also being present in the kernel (that's the reason why some(?) official updates also work(ed?) when choosing "restart" instead of "update", while ours don't [error 003]).
So I used my Touch, downgraded it to (stock) 5.1.2, and removed the production keys.
Currently available Touch updates are "plain" OTA updates, in-kernel-image-updater just skips them, so removing Amazon's keys from rootfs will certainly disable applying of Amazon's Touch updates. I was speaking about PW updates which are a bit "different beasts".
On PW without Amazon's keys update will fail when "Update your Kindle" will be selected, but it should work on reboot, because PW update bundles are recovery updates recognized by in-kernel-image-updater.
kindletool convert -i
helps to distinct recovery updates. BTW, I guess, in-kernel-image-updater also have a strict filename pattern, so, I think, that's why updates with PW_
prefix didn't work.