Added1
Three more answers from the developer on the FAQ page: what this is for and whether it is a honeypot, what happens to your files if one person stops or the server goes off, and why NMTS exists if the recovery program needs no server.
Changed1
The developer page's sentence about not being able to verify the code your browser receives now also says what is done so that nobody else can change that code.
The old sentence said only that you cannot check the served code against the repository, which is true and was read as if nothing stood behind it. The sentence now names what does: the security policy every page ships with, the server with no open port, and the build from one recorded commit. It also says that this narrows who could change the code rather than proving anything.
Security1
The web framework and the image library were raised to the versions that close the advisories published this week.