I had misread [link|http://arstechnica.com/paedia/n/net/net-2.html|page 2]. I had thought that they just used a hash to sign the file so that any change to the file broke linking. They don't. Instead they cryptographically sign the hash value. Only with access to the private key can you produce a new file which will link with the old.

So they can make reasonable patches.

It does raise questions about key management though.

Cheers,
Ben