SL Baur <steve(a)xemacs.org> writes:
 It depends upon which version of the package-index file you are
using.   
Offhand, I didn't even know what package-index was in question.  I
already had the July 29 sumo tarballs installed, and was just toying
with the package manager when I ran into this bug.  As it happens, I
just now manually acquired the latest mailcrypt-2.02 package and
installed it...and now when I run the exact same sequence in an
"xemacs -q", it claims that entries are not signed at all.  This is
notwithstanding the fact that I now have a package-index.LATEST.pgp
with modtime of just moments ago, plus the prev. version as
package-index.LATEST.pgp~, with modtime July 29 21:50.
???
 You can either strip out the signature, or update to the most recent
 package-index file on the FTP site (which includes a pointer to an
 updated version of the mailcrypt package). 
As I said, I already got that later mailcrypt.  But I have no idea how
or why any of this has occurred.  Installing the latest mailcrypt
shouldn't have affected the determination of *whether* the packages
are PGP-signed.  In fact, now, after starting up the package manager
(and telling it to continue even though entries are not signed), the
mailcrypt library is not even loaded -- the variable mc-version is not
known.
I am *so* confused.