This curl function actually came up in conversation with someone about a month ago. We figured that there was no way the core transformation was secure, and that was about the extent of our interest in it.
Right! I think people have a misapprehension that working cryptographers feel a kind of moral urgency to ensure that popular software is cryptographically sound. When confronted with insane stuff like IOTA, most cryptographers just drink.