I've milled/decapped ICs in the past to varied levels of success for the MAMEDev. I have most everything I need, except a good optical microscope and a logic probe, the latter of which I have already ordered on Amazon as my old DP21 crapped out on me, the prior of which I can borrow from the university. Back in the old days you couldn't read from EPROM using decapping, only MASKROM, but thanks to microprobing thats not the case. And with this sort of MC package, blackboxing is nearly impossible from what I understand. Decapping is a nearly 100% foolproof way of gleaming what we need to know, IF you can do it correctly. The downside is, its super expensive unless you already have/can get for cheap what you need, and I personally don't have a ton of MCU decapping expertise.
The main problem is working with Atmels directly off-the-die, as from what I've discussed with others on IRC, using anything like RFNA (or any fuming acid for that matter) is extremely destructive on the dieset of these types of microcontrollers. I'd hope that this would be a last ditch effort, and you have some good ideas regarding dynamic PSJ-to-PS3 reading. Let's hope that turns out to be the "easy" way of doing it.
Also, if it comes down to it, I think between myself and Mushy that we may be able to pull what we need. I can practice on some older Atmega16s, then after we get ahold of either a PSJB or X3JB, I can decap it (if there's no security mesh in place), grab some high res die closeups, and send it to Mushy to second opinion it, if he's interested.
Well, I was hoping if I asked the chip nicely, it would give up its secrets lol