[rajivm]

At the least though it could be https.

[schoen]

I also suggested that in the meantime the author of the article can provide a SHA256 checksum, so you can see if you get a different key than he does.