Recipient's public rejection of two red-team findings

Replying to a request from Rob Hamilton to check direct messages, JW Weatherman says the two issues reported to him as critical now need to be addressed publicly and calls this not responsible disclosure. He then answers both: that his project does not verify signatures on Bitcoin Core, which he says is almost certainly untrue, is being checked, and would be like a missing second seatbelt given that downloads come from bitcoincore.org with implicit signatures and TLS; and that it downloads from GitHub, which he calls obviously not an issue. He writes as "we" for a project the post does not name. Held because it is a named recipient's first-hand account of being on the receiving end of the AI-assisted red-team sweep, and because it is one of the few captured disputes over the sweep's disclosure practice rather than its output. Both the findings and his rebuttal of them are the parties' own statements; neither is verified here.