It was easily noticeable thanks to Chrome not trusting it in the first place (which also would have prevented spoofing the download server, though I suspect there's more to protect that than just a key).