I did configure them that way, and I confirm that was « not enough ». Maybe I did not have enough filters ? I have no time to try at the moment, but will have a look a bit later…
You and I don't know exactly how Apple confirms authenticity. This obviously needed to have been considered —otherwise, it would not have received support from Apple and the giant CDNs.