I also found this:
http://git.ghostscript.com/?p=urw-core35-fonts.git;a=summary
and they're called urw-core35-fonts here. It might be wise to ask
upstream to clarify before choosing the new package name.

I'm not sure where your Version == 1.0 comes from. If they're versioned
only by date now, then you have two options. Use Version: 0 in the new
package in anticipation of upstream eventually reintroducing semantic
versioning. Or, Version: YYYYMMDD. Admittedly, the latter looks nicer
and upstream already said they'll stick to it.

If you worry about upstream versioning sanity, then stick with
Version: 0
and follow the snapshot versioning guidelines.

> There's also one more option, and that is to base the package on upstream's
> git repository and the snapshot scheme, because we would be using snapshot
> string in the package name anyway. And it would also solve one more issue
> that upstream is not shipping license files in the archive. (I have already
> contacted to correct this.)

The exact location of the source doesn't matter too much as long as it's
official and pristine. I agree it might be better to use the git repo
directly since it contains both the licence indication and its full
text.