[JoshTriplett]

Also, in the mailing list thread, someone actually went back and verified the contents of all the old tarballs and compared them to the bits from Git, since otherwise someone could have changed the tarball releases.