Post #2095335

@corbet also of note is that we found that "libarchive" was released/signed by the same gpg key/author so that obviously should be treated with suspicion as well