Imo the problem is of the issuer. They only opens holes by doing this kind of things. Imagine if you already secured the admin@domain.com and tomorrow the issuer thinks that admin-ssl@domain.com could be used for validation. Now what, you should keep up with their updates every hour?
He also doesn't state that the output should be right at first decompression try. By using this you could encode multiple bits and then generate various wrong archives, knowing that after 1000000 tries he would get a correct decompressed file.
