My spamassassin updates daily by running sa-update. Recently, I’ve been getting failure notices that mirror spamassassin.kluge.net was no longer available. This was because of a known bug, apparantly. So, I deleted the MIRROR.BY file and ran sa-update again.

This caused problem number two: GPG key verification failed. This was also a known issue, so I had to do: 

wget http://spamassassin.apache.org/updates/GPG.KEY
sa-update --import GPG.KEY

And then everything was OK again.