I assume I must report it at https://bugs.g10code.com/gnupg/index as the installer and the sources to make the installer are hosted at ftp://ftp.gnupg.org/gcrypt/binary/ and signed by the developers. Thanks for the help.