Last week this was discussed in the comp.security.misc newsgroup and one of the project engineers joined in to give a little more information. You might be interested in reading what he had to say.

http://www.der-keiler.de/Newsgroups/...2-12/0349.html