Univ of Michigan, publishes code, doesn't sign the tarball, doesn't even provide a certificate for a secure connection to get the source, still in 1980s mentality and innocense, or is it irresponsibility for hire?