>>> I was about to say you could push to master, but since the new
>>> substitute-binary will refuse any unsigned archives[*], it may be wiser
>>> to push to a special branch so we can test it in real life before
>>> merging into master.

>> Should the special branch be based on ‘master’ or ‘core-updates’?

> On ‘master’.

Done.  Since some tests on ‘master’ fail for me, could you run ‘make
check’ to make sure that it doesn’t break anything?