yeaaaaaaaah·قبل 7 سنوات·discussExcept the signing key was also downloaded over plain HTTP so all bets are off.