I was wondering about that. Every update when it says it's unsigned I get really nervous and triple-check the source and monitor traffic during the install.