Currently part of request parameter re-ecoding is the re-encoding of the request parameter names. This is done in the Util.fixEncoding method. Parameter name re-encoding is done using the URLDecoder.decode method with the idea, that the name is still URL-encoded.
This does not seem to be the case – in fact a test shows, that (at least FF 2) sends request parameter names not URL-encoded but encoded with the form character set.
So the correct way probably (this is real trial and error stuff, unfortunately) is to not do URL decoding but to just re-encode the parameter name.