Otherwise rpm can bitch and we get confused.
Trying with --nosignature which I'm not 100% sure is the right option.