Signing metadata requires a lot of manual interaction and knowledge of the customer. This was the reason why we never implemented it for SUMA as the benefit was very low.

Now with the change in the zypp stack to not allow installing unsigned RPMs without user interaction or completly disabling GPG checks the benefit of such a feature increased.

I plan to implement this without any GUI support.

• the customer need to create an own GPG key pair
• the customer need to enable this feature in the config and configure the keyid and the password
• during metadata generation the taskomatic task check, if metadata signing is configured and only then sign them
• if metadata signing is configured, we need to change the GPG check options of the repos.