PackagesOrigin metadata should account for the fact that a vendor may have more than one possible signing key

[dralley]

An organization could may choose to rotate or replace their signing key, and it may be done gradually (without resigning all packages immediately) during which there could be a window in which some packages may be signed by one key and other packages may be signed by another (or both, as RPM packages can include more than one signature)

I don't know whether this is actually enforced, but it's best not to encode the assumption that all packages would match a singular declared key at all times - might be better to declare a list of acceptable keys for an origin.

https://github.com/amazonlinux/dnf-plugin-support-info/blob/main/test/fixtures/supportinfo-1.0.xsd#L274

[dralley]

Example: post-quantum package signatures being rolled out in a LTS distribution that did not originally use them.