Re: cannot download packages from elpa

[Dmitry Gutov]

On 03.10.2019 4:55, Stefan Monnier wrote:
> If you use an older Emacs to fetch the packages you need to first update
> the keys or disable signature checking.

I wonder: if we served ELPA over HTTPS only, would the signature 
checking really add any tangible security benefit?

To continue that train of thought, if the only key we had to worry in 
that respect is the HTTP certificate, the older releases of Emacs would 
need no updates over time (aside from changing the repo url to https:// 
once).