There may be other complexities to it, but I never thought the GPL v2 explicitly forbad DRM signed apps. Also it was my understanding that providing the source could be a URL, which is the easiest for everyone involved, but you could also provide it upon request by mailing a CDR and still be compliant. The GPL does not require that the source be included with the distribution of the program, just that the source is available to anyone who gets the compiled program.