Maybe I'm over-simplifying this. As I understand Saurik has been able to fool Itunes into accepting a non-Apple signed firmware bundle by emulating Apple's signing mechanism. In a similar way, shouldn't it be possible to emulate Apple's Activating mechanism, and possibly also send a permanent "factory" unlock command?? Would be great if Dev-team and other experts can figure this out!