Not surprised at all. I remember all of the heated discussions (even here on HN) around there being absolutely no need for HTTPS because "everything is signed with PGP".

Exposing all of the internals of something to any and all MITM keeps on demonstrating how it's a dangerous idea.

Hopefully this example settles at least some of this pointless discussion.