Revert "_dl.sh: drop support for downloading keys from urls"

This reverts commit dee8952.

_dl.sh

@@ -385,7 +385,11 @@ EOF
       fi
     else
       for key in ${keys}; do
-        gpg_recv_key "${key}" >/dev/null 2>&1
+        if [[ "${key}" = 'https://'* ]]; then
+          my_curl --max-time 60 "${key}" | my_gpg --quiet --import >/dev/null 2>&1
+        else
+          gpg_recv_key "${key}" >/dev/null 2>&1
+        fi
       done
 
       if my_gpg --verify-options show-primary-uid-only --verify pkg.sig pkg.bin >/dev/null 2>&1; then
@@ -620,7 +624,13 @@ EOF
         ssh-keygen -Y check-novalidate -n 'file' -f /dev/fd/3 -s pkg.sig < pkg.bin || exit 1
       else
         for key in ${keys}; do
-          gpg_recv_key "${key}"
+          if printf '%s' "${key}" | grep -q -a '^https://'; then
+            # gnu-keyring.gpg can take a long time to import, so allow curl to
+            # run longer.
+            my_curl --max-time 60 "${key}" | my_gpg --quiet --import 2>/dev/null
+          else
+            gpg_recv_key "${key}"
+          fi
         done
         my_gpg --verify-options show-primary-uid-only --verify pkg.sig pkg.bin || exit 1
       fi