Add a fixme about the use of an unsigned repo