The Actual Problem I am trying to solveI am trying to automatically configure my fedora installations via salt to automatically have the rpmfusion repositories installed. In order to do this securely I need the gpg key so that packages can be verified before they are installed. However, I am unable to find a way to securely download rpmfusion's keys. For example, if I was making a google chrome repo I would have something like this.[google-chrome]name=google-chromebaseurl=http://dl.google.com/linux/chrome/rpm/stable/x86_64enabled=1gpgcheck=1gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pubHowever, for rpmfusion the closest thing I have is the following (Note this is untested):[rpmfusion-nonfree]name=RPM Fusion for Fedora $releasever - Nonfree mirrorlist=http://mirrors.rpmfusion.org/mirrorlist?repo=nonfree-fedora-$releasever&arch=$basearchenabled=1metadata_expire=7dgpgcheck=1gpgkey=http://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-nonfree-fedora-$releaseverHowever, note that I am download via an unencrypted channel (http instead of https). So my question is the following:Is there a way for me to securely download rpmfusion's public key?
How to securely download rpmfusion keys
security;key authentication
I don't think there's a way to download keys securely, rather you can download them and confirm that they're legitimate using the steps outlined on their keys webpage.Trusting Package IntegrityexcerptVerifyIf you have newly installed the rpmfusion-*-release.rpm repo packages, and wish to verify its keys, check the fingerprints below.If you want to verify the key before to install the rpmfusion-*release.rpm, you can use  $ gpg --keyserver pgp.mit.edu --recv-keys Key_ID Where Key_ID is 172FF33D in the case of RPM Fusion Free for Fedora 19.