Your first link requires an already-compromised boot path; it cannot be used on the San Bernardino phone. Your second link describes software that only works on

Your first link requires an already-compromised boot path; it cannot be used on the San Bernardino phone. Your second link describes software that only works on unencrypted devices, which likely means it needs to be able to grab the password hash directly (which it's free to then brute-force off-device, avoiding the max-attempts erasure). Whether Apple has previously signed a piece of PIN unlock software or not completely misses the point: they decided to do that. They were not compelled. They expressed trust in the software because they trusted it. Not because they were forced to. Compelled speech is constitutionally prohibited. Maybe give CVE-2014-4451 a try?