I have a PR200 with the Panorama Scan and Time Domain options installed, I can provide firmware, software, documentation(Full manual, pretty sure its 600 pages or something), etc. to anyone who would like to give cracking the option encryption a shot. I would imagine this encryption is still being used on the latest devices, so it may be worthwhile to look into.
The firmware is just an .itb file that can be extracted in HexWalk leaving you with a .squashfs archive which I assume is what has the good stuff in it, a 10MB "C0" file, and an 83.8MB C0.gz file.
Poked around in the .squashfs file for a bit, to say it's intimidating is an understatement. Ended up finding the lines of code where it calls openssl/crypto when you go to type in the option key, but I have no idea where to go from there.
As the PR200 is Rohde's latest portable receiver, I cannot provide option keys for security reasons.