I imagine it's disheartening to see so much distrust and I'm truly sorry for that, but you could've seen that coming when posting to HN of all places :D

As for the cert: it _could_ be stolen.

Least flak wouldv'e been a github repo. Most people wouldn't even bother check what's in it and if it matches a binary download, they'd just assume someone else would check ;)

I bet the XML parsing and the sound synth are exactly the two things you're least and most proud of? :D I honestly recommend taking a look at JAXB. You start from a schema description and generate java classes from it. Then you just stuff these classes and a conforming XML file into a JAXB Unmarshaller and get a clean instance tree of the file. Such a tree can then be poured back into a file by way of a Marshaller.