My init.el uses this to initialize packages:
(package-initialize)
(add-to-list \'package-archives \'(\"gnu\" . \"http://elpa.gnu.org/packages/\"))
(
This is not an error caused by misconfiguration but is due to the change of the file package-keyring.gpg from Emacs 26.3. As stated from the release note:
New GPG key for GNU ELPA package signature checking.
I believe the newer packages from GNU ELPA repository are signed for this new keyring to check.
The simple way to fix it is to upgrade to Emacs 26.3.
But if you were like me, who don't bother to upgrade, you can download the package-keyring.gpg file from here and put it in the etc/ directory under your Emacs installation location. In my case, it is /usr/local/share/emacs/26.1/etc/package-keyring.gpg. It might be different locations for different installation methods (apt, yum, etc.) on various platforms (macOS, Windows, etc.).
Alternatively, you can try to install the package gnu-elpa-keyring-update to automatically update the keyring in the future.