> I was about to say you could push to master, but since the new
> substitute-binary will refuse any unsigned archives[*], it may be wiser
> to push to a special branch so we can test it in real life before
> merging into master.

Should the special branch be based on ‘master’ or ‘core-updates’?