unhammer: re zip attack, yeah, that's a known problem with zip files. You have to build in special logic to any upload that automatically unzips them looking for it. See: https://en.wikipedia.org/wiki/Zip_bomb

re metadata: have people analyzed the metadata of the Snowden files? I haven't downloaded anything but one or two of the redacted files, so I don't know how useful it is in this case (the only ones to see the metadata being the journalists, which aren't really equipped to judge authenticity).