most of the packages on my mirros (espri.arizona.edu) aren't authenticated either. I'd like to hear any information on this as well.