[Galaxy S II Original Android Development] Phil3759:
I have even more strange thing:

The key seems a standard test key included in Zipsigner2 application

Here's attached an example of test-signed.zip file using the bundled testkey

The output of signature verification for my attached test-signed.zip file is:

s 249 Fri Feb 29 03:33:46 CET 2008 META-INF/MANIFEST.MF

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

302 Fri Feb 29 03:33:46 CET 2008 META-INF/CERT.SF
1714 Fri Feb 29 03:33:46 CET 2008 META-INF/CERT.RSA
sm 244960 Fri Feb 29 03:33:46 CET 2008 META-INF/com/google/android/update-binary

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

sm 640 Fri Feb 29 03:33:46 CET 2008 META-INF/com/google/android/updater-script

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope

jar verified.

Warning:
This jar contains entries whose certificate chain is not validated.

Here's the output for CWM-SuperSU-v0.94.zip:

s 393 Fri Feb 29 03:33:46 CET 2008 META-INF/MANIFEST.MF

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

446 Fri Feb 29 03:33:46 CET 2008 META-INF/CERT.SF
1714 Fri Feb 29 03:33:46 CET 2008 META-INF/CERT.RSA
sm 190552 Fri Feb 29 03:33:46 CET 2008 META-INF/com/google/android/update-binary

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

sm 1819 Fri Feb 29 03:33:46 CET 2008 META-INF/com/google/android/updater-script

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

sm 969701 Fri Feb 29 03:33:46 CET 2008 system/app/Superuser.apk

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

sm 91980 Fri Feb 29 03:33:46 CET 2008 system/xbin/su

X.509, EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
[certificate is valid from 29.02.08 02:33 to 17.07.35 03:33]
[CertPath not validated: Path does not chain with any of the trust anchors]

s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope

jar verified.

Warning:
This jar contains entries whose certificate chain is not validated.

The Warning is due to the JDK 7 I presume as it gives me the same output warning on the valid chainfire CWM-SuperSU-v0.94.zip

As you see, my test-signed.zip file seems to have same signature as the CWM-SuperSU-v0.94.zip. However, my test file will not flash in 3e recovery while Chainfire will

So, basically, there's a specific certificate/key pair needed. As far as I know, no one else except chainfire and Koush did it, and they both if I am not wrong have some links with Samsung dev team...

About CM9, I did not try from stock 3e, but in their guide, they give steps to install cwm first...