On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
AFAIK these keys are calculated by the bootrom code using the GID (model-specific) key which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to have some kind of bootrom code exec for the specific model you have the kernelcache for.
The actual keys are stored in the KBAG section of the .img4 wrapper format, encrypted with the GID key.