Comment by Eli_P

Oracle's practiced the same policy with VirtualBox distributions and that's been fine because they signed packages. VideoLAN signs their packages too. It seems to be a common practice for a highly loaded services to outsource as many cryptography to clients as possible. I think for the same reasons Google dropped CSRF tokens for their api in favor of different security measures.