hairyfeet writes: "The paper submitted here along with the original PDF says these researchers have found a way to take over a repository without needing the private key. Is this a serious risk, or just more FUD?"
Never ask two questions in a business letter. The reply will discuss
the one you are least interested, and say nothing about the other.