RPM API is confusing and it's easy to get it wrong when verifying package signatures. Call 'rpmkeys --checksig' which is more rebust here - RPM authors should know how to use their API. QubesOS/qubes-issues#2534