libdnf does its own signature verification, but this can be tricked by placing a signature in the main header