Upstream overhauled part of their repository, making it harder to build from a tarbal. (need to deal with git submodules) However, they do ship sha1sums and gpg signatures now, so we use those.