They are not private. They are always the same for every package created with an SDK version so I believe they are public. I have a thread pending reply on this but i think it's ok to go as is.