Execute restorecon after restoring app_process
Check in the tools to sign the recovery zips

This is SignApk from AOSP 4.4, except for the addOtacert() call.

The files need to be signed with -w in order to be accepted by stricter
recovery (e.g. the original ClockworkMod Recovery). The signing keys don't
matter so much, these seem to be the same ones used for SuperSU etc.