Is there a documention how wad installing happens?

Hi I have read there are wad files.
They are just archives mit with a signature on it.

My questions:
There is a sign bug

strcmp(good_hash, file_hash);

Its in boot1 and let you run an other bootloader (YEAH!).

There is a fake sign bug, too. How does it work and why is it needed?
I have read that you need it to install Channels and IOSes. How does the install work?
Why can't you just write the IOS / Channel to the right place on the NAND flash and thats it?
I thought broadway can write on the flash disk directly.

How happens (technicaly) when a wad is installed? Where is there difference between a normal wad containing normal data and a wad containing a channel / ios?

When it doesnt work, why can't you take the key from starlet (or whatever checks the sum) and use it to sign your own wads?
Or maybe overwrite the key in RAM and change it with your key, so it recognize your sign as right?