According to online reports (bug tracker, reddit) and tweets from the authors it appears that:
The updates are signed by PGP (good)
The version is checked to avoid downgrade attacks (good)
The signature use an old 1024 bit DSA key, never renewed (bad)
We can conclude:
This mechanism is not at the sate of the art because of a deprecated signing algorithm, ...