bug#35739: Bad signature from GNU ELPA

[Eli Zaretskii]

> From: Stefan Monnier <monnier@iro.umontreal.ca>
> Cc: rcopley@gmail.com,  35739@debbugs.gnu.org,  npostavs@gmail.com
> Date: Wed, 22 May 2019 12:20:01 -0400
> 
> It solves the problem by refraining from decoding until we know
> positively that it needs to happen.

You refrain from decoding what?  E.g., Lisp files must be in UTF-8,
right?  And what about the descriptions we show in lisp-packages?

Or maybe I don't really understand why we need to decode _anything_,
since we just download a .tar archive, right?

> > I'm also mildly worried about the incompatible change in url-insert,
> > which is a general-purpose function not limited to package.el and its
> > signature verification.
> 
> Yes, this part should definitely not be in emacs-26.

I'm actually asking why it should be on master.

> the change in url-insert only affects the case where the HTTP
> headers returned by the server specify a particular "charset", which
> is not the case when downloading .tar and .el files from
> elpa.gnu.org AFAICT

Why not? isn't that dangerous?