Actually it is that simple.
It's sadly not that simple. There's two distinct signatures required for the two steps to getting homebrew on the PS3: a. package installation, b. app execution. The latter was known, but not possible because the tools to do it weren't properly working. The former was unknown until today. Working tools to do both were released only today so now signed homebrew is starting to crop up.
It sounds like the generated signed packages are perceived to be valid only due to the modification though. *shrug*
As for how this does not facilitate piracy:
Traditionally the method of PS3 jailbreaking involved a payload delivered via usb that injected code into lv2. This allowed (including the installation of falsely signed packages - homebrew) the usage of system calls that re-mounted directories. This functionality was used almost exclusively for playing backups (pirated software, obviously).
The modifications Geohot made do not touch lv2, and therefore do not provide the necessary syscalls for very specific reasons:
a. doing so would mean modifying lv2. Modifying lv2 = a bricked console. Absolutely bricked, unless you have a NOR flasher.
b. the syscalls are basically irrelevant to homebrew itself.