The photos are legit, obviously, but the emails as are yet not authenticated. All we got to see was a PDF printout. The full emails, with DKIM headers, being released would solve this problem instantly.