Here's the scenario that the original reporter added: > if the update blob ​indicates a key other than the hardcoded one, it downloads the requested public key

Here's the scenario that the original reporter added: > if the update blob ​indicates a key other than the hardcoded one, it downloads the requested public key from the VLC update server ​over HTTP and does nothing further to verify the key itself. This means that all an attacker would have to do to serve a malicious update would be to sign it with their own key, then serve the matching public key when VLC requests it. I think they should've included this in the original report, because if true then it really changes the severity.