bug#35739: Bad signature from GNU ELPA

[Eli Zaretskii <eliz@gnu.org>]

> From: Stefan Monnier <monnier@iro.umontreal.ca>
> Cc: rcopley@gmail.com,  35739@debbugs.gnu.org,  npostavs@gmail.com
> Date: Sat, 18 May 2019 18:36:50 -0400
> 
> > I don't know.  I don't yet have a handle on what happens here, and
> > therefore I don't understand how replacing url-insert-buffer-contents
> > with url-insert should fix that.  I'm probably missing something.
> 
> After playing some more with it, I found a few problems, tracked down
> the origin of the decoding (which was introduced for the case where we
> download the <pkg>-readme.txt description file) and installed a patch
> into master which should fix this right.
> 
> Now the question is how to adapt the fix for emacs-26: the patch
> I installed is too invasive for emacs-26, I think.
> 
> Maybe we can patch over the problem by using `last-coding-system` instead
> of `utf-8`?

I don't think I understand the change enough to say something
intelligent here.  The commit explains, o some extent, why the
original code failed, but it says nothing about the way the new code
solves the problem without introducing new ones.

I'm also mildly worried about the incompatible change in url-insert,
which is a general-purpose function not limited to package.el and its
signature verification.