Invalid hash, when syncing with packages.icinga.com

I am trying to set up a local repository on Windows.
Both Sync-IcingaRepository and Update-IcingaRepository gives the following message:
“The repository hash for the cloned repository is not matching the file hash of the files inside. Removing repository data”.

When i use the the “Foretrust” parameter, everything works fine, but that’s not best practice.

Need some hints here, or is this maybe a bug?