The signature gate asks a throttling host again, and a note is not stale when its signature could not be fetched

[DevomB]

On #156 the Source manifest job failed with nothing changed under it: freedesktop.org answered HTTP 418 to the runner's fetch of libevdev's .sig, so verify-signatures.sh --strict counted libevdev unverifiable (correct: a signature it could not check) and then also called its no-usable-key note stale, because the note was never tried. Two failures for one throttled request, and a re-run was the only cure.

• quiet_fetch tries again after a pause on 418, 429 and 503 (three tries, 5 s then 10 s apart); a 404 or a missing file is an answer and is not retried, so sources that publish nothing stay quick.
• A source that was unverifiable this run has its note left alone: the note is stale only when the key it excuses is held or the source is gone.
• The fixture suite has the case: a row declaring a .sig that cannot be fetched, with a note, fails --strict as unverifiable and is not called stale.