Windows update: "Some update files aren't signed correctly." How to find out which?

Using Windows 10 build 10586, I get the following error

Some update files aren't signed correctly.

Error code: (0x800b0109)

When it tries to download the new 11082 build.

I have checked the certificate stores and they seemed okay (I might have untrusted some CAs myself but none are MS-related.)

I have seen two threads on MS community, but they do not offer any real solution.

I am happy to troubleshoot this myself, but I cannot find relevent info in the logs. I have tried CBS and DISM logs. No mention of this error...

I used the media creator to "upgrade" my system which returned it to build 10586. Windows update was then able to download and install the 14251 build without any problem.

It seems there must have been some kind of corruption.