The private signing key + passphrase are normally present on hera. So all tarball signatures could be compromised.

This is an example

The site looks almost identical to Fukushima: google earth link

Here is the link to the research paper: http://arxiv.org/abs/1007.3284