I'm a little naive when it comes to SSL/TLS. I've been wondering whether the reason for the delay is that because with this compromise Apple's update service is no longer a secure channel through which to distribute a fix. So now they're scratching their heads trying to figure out a way around the issue, possibly coding up something that uses OpenSSL. Is this line of reasoning unfounded?

EDIT: Great points about the checking of the signatures. Let's hope there's not a second bug that can bypass this in some cases.