Afaict, you don't actually need to be downloading the content in order to check for updates and the signing is not mandatory ("should be signed" not "must be si

Afaict, you don't actually need to be downloading the content in order to check for updates and the signing is not mandatory ("should be signed" not "must be signed"). Don't the content providers already pose as peers and even share (sometimes corrupted) torrents in order to track down infringement? The feed could even be legitimate in and of itself, even when signed, but still pass on user information to a centralised server. I'm no security expert and it's quite possible that it's all quite safe, but to my layman's eyes it seems there's substantial potential for abuse, especially to unsuspecting users.