tarsnap has always been unfree, but this wasn't expressed properly, so it wouldn't be caught by allowUnfree = false.