I just used this feature with them the other day. The way it works is that if you enable SSL on a site passing through them, they'll auto-generate the front-end cert. I believe you can add your own cert for a premium. The back-end cert can be set to validated/unvalidated/unencrypted.
Chrysler worked with the guys that discovered the vulnerability and no doubt simply patched the current known bug allowing exploit from the cellular uplink. The system could be vulnerable again if a new exploit is discovered. I updated my Jeep a week or so ago and haven't had any issues -- yet.
Edit: After reading the paper it looks like the update from Chrysler blocks inbound tcp/ip now, and Sprint is also filtering traffic more aggressively.
Pilot here. I will confirm this, and also add that there are many other ways to find an airport (paper maps, atc, handheld aviation gps, built-in gps, airport beacons at night, and also just looking out the window). In an emergency, the last thing I'd do is have my head down in an ipad/iphone. From the aerial shot it appears clear that it's not an airport, but it is probably the largest field around, so it would be a target in an engine failure scenario regardless.
A few seconds could shut down reactors, gas lines, slow trains, trigger stop-lights (e.g. preceding tunnels), alarm people in parking decks, etc.
Earthquakes are known to sometimes be preceded by unexplained balls of light much further in advance. If this phenomenon is related, the warning period likely exceeds just a few seconds.
