There might be one method left to get root access and retrieve necessary information: Booting into recovery mode with either the update.img from rupor-rescue.7z or figonet's
update.img which are simple filesystem images that only give root access to the device via usb serial.
With this kind of access it should be possible to retrieve the necessary information from /proc/mtd and to dump the appropriate /dev/mtdblock which contains the keys needed to create packages to free the device.
Who dares?