Draw your own conclusions about the variables or test them yourself. If I'm wrong about the private-key, it's easy enough to generate a completely new set of keys for this subversion. It clearly shows just how easy it is to load and use a CSP module. At this point, with just the information presented so far, it shouldn't take a cryptographer or a security expert to see that this collection of utilities, DLL's, etc. It should also be obvious that these tools can just as easily be used for malevolent ends as for benign ones.
Tools are often like that.
Which is why you should always confirm what they are supposed to do and where they came from. The descriptions in the Cryptonym report and the ReadMe's of the ZIP-file go a long way to making subversion easy, or at least understandable enough to start reading up on cryptography. The main missing piece is a tool for making new RSA signing-keys, though that's the kind of thing one would expect to find on the web, or even by using the CryptoAPI itself. I could be wrong, but it's worth trying. Even if I'm wrong, if you have a little experience using CryptoAPI, you already have everything you need at your disposal, and you can just generate a new RSA key.