[Yum-devel] gpg key importing

[seth vidal]

> The problem with all of these is that any "get the key from this URL"
> thing is how can you trust that URL?  If you don't trust where you're
> downloading packages from, why can you trust a website where you pull a
> key from in an automated fashion any more?

Acknowledged, and yet how else do you get gpg keys installed?

how does up2date do it on fedora core?

how does anyone?

-sv