I am marking this as invalid/wont-fix.
First, what it complains about is missing lipstick on a pig. The solution it
suggests protects against spoofed patches only if they happen to depend on
patches not in our repo. This can easily be avoided simply by making the spoofed
patch in a current clone. We should be able to /reliably/ detect spoofed patches
or not at all.
Second, and more importantly, the "fix" actually breaks Darcs in an absolutely
horrible way. See issue2605 for details.