[NiLuJe]

You can't run custom recovery packages without also patching the initrd to accept your signing key.

The only practical example of that ever having been done was in @yifanlu's FW 3.x-on-the-DX thingy, IIRC (which predates KindleTool, but the concept is still the same).

(Also, as the error says, current initrds *require* a 2K signing key, while our OTA JB key is 1K, because that's the length required for the dev key slot. IIRC, there's only one 2K slot: 2).