Ya, I've been waiting on a more official reply from the maintainers. The current homepage on SF really looks like a web-defacement and not something that is official.

To make things worse, the "new release" of the software is signed using the official key. Does that mean that they were able to deface the site and nab the private keys at the same time?