To unpack a XenServer hotfix, run the command:
gpg --homedir /opt/xensource/gpg/ --no-default-keyring --keyring /opt/xensource/gpg/pubring.gpg --output hotfix.unsigned --decrypt <XSUPDATE.the_filename>
This will give you the file 'hotfix.unsigned'. You can then do 'sh hotfix.unsigned unpack' which will give you a tmp directory with the unpacked rpms. You can then install the rpms.
And I'm sorry that this process isn't seamless on XCP like it is on XenServer.