Agreed. This article led me to believe that there won't be any hashing/signing/protection at all for these updates, until I read the Ars article.