So the problem is, that some software is downloading unsigned (or not verifying) signatures on their updates. That is NOT best practice. Never trust what you download. Even a signed file of versions ...