Sry if I'm wrong but I think Dax waits for it to be cracked then goes in for the kill and makes his firmware.
Firmware 3.5 was actually decrypted as soon as it was released, as Sony did not change the decryption keys.
weren't it only 99% decrypted on the day of release?? like the reboot.bin werent fully decryptable? i might be wrong though.
according to pspupdates, 3.50 OE is only 5% complete atm, so we're gonna have to a while before gettin it. lets just hope DAX doesnt have to resit exams so he can pwn the firmwares more lol