> How does someone "find" a PS3 root key?

First things first: it's not a "root" key.

How you get it: you do some boring buffer overflow or integer overflow exploit (which you do have to find first of course), and then you do the computations we detailed at the 27c3 talk.

Hardly rocket science. But it was indeed a (non-essential) missing piece.

> Do they really have Sony's signing key?
Yes, we have most of their signing private keys.