Why would DHL publish -all- of the signatures on the web without even a rudimentary audit/security review?

This is 2013. It's not about the "grab". The act is publishing, making available. Those who access are not the gatekeepers.