It's times like this when I think we could only proceed if someone working there "leaked" the code (or, more precisely, a functional representation of its logic) to a group of secretive reverse-engineers and they came up with a credible clean room implementation
Author here. As the comment above notes, it's a leak of the signing keys which would be needed to free this. The actual blob itself can be reversed and replaced with enough of someone's time. The only other prospect is a flaw in the code which verifies the signature. The PS3 ECDSA break was an amusing example of this (though technically in that case, actually a flaw in the signing code, not the verifying code).
But the thing is, if those keys were to be leaked the damage would be irrepairable. You could legally donwload the reverse engineered firmware and then "acquire" the key and plug it in.
They won't be leaked, though. With a large western coompany like NXP, especially being that it's one with crypto-related business units, it's basically guaranteed that the keys will be in an HSM. There's always a slight chance they're inept and the private key is sitting in someone's home directory and they could decide to leak it, but in this case the chances seem very low.
Might have better luck with the Taiwanese hardware vendors - as I recall a major Taiwanese PC motherboard maker got hacked recently and UEFI secure boot keys were taken, so they probably weren't storing them in an HSM and don't have proper security practices in place for cryptographic material.
The code is useless without the keys used to sign it; even if you get a custom blob, you are unable to have it recognized by the device in question. This is tivoization at its finest.
