gwdg.de contains unsigned rpms: risk of apt repository compromise?

Dear Editor,
 
I found out recently that there is an increasing
number of RPMs in apt repository on gwdg.de which are
not signed. The apt repository on gwdg is very usefull
since it allows people to automagically update their
distribution with latest packages (as you reported in
one of your articles)
 
The lack of RPMs signature generates two issues:
 
a - packages cannot be installed via apt (latest
apt/apt-libs/synaptic refuse to install unsigned
RPMs): it is annoying but a minor issues since you can
always install the downloaded package via rpm -Uhv
 
b - potentially VERY important - we could risk a
situation similar to debian where compromised packages
(i.e. with Trojan horses) are spread on our Linux
systems
 
Is there any reason for having unsigned packages? Is
there the risk that our repository have been
compromise d?
 
Maybe I'm too paranoid, but I think it is better to
verify it... Can you eventually ask it on your weekly
document?
If there is no issue than I think that the maintainer
of those package should start to sign the RPMs once
again...
 
regards,
Timur
 
Note: if possible I would prefer that my address
doesn't appear on your magazine.