PSGML has incorrect RPM signature?!?

[Dave Roberts]

Either something got screwed up at Red Hat or somebody cracked
something. Specifically, I'm trying to install PSGML via Yum on FC4. It
looks like the PSGML is not signed with the correct Fedora key. I have
verified the 0x4F2A6FD2 key as correct on the Fedora website, so it
looks like all that is installed correctly. PSGML is apparently signed
with a key ID of db42a60e. Here's the Yum console transcript.

-- Dave

Setting up Install Process
Setting up repositories
updates-released          100% |=========================|  951 B
00:00
extras                    100% |=========================| 1.1 kB
00:00
base                      100% |=========================| 1.1 kB
00:00
Reading repository metadata in from local files
Parsing package install arguments
Resolving Dependencies
--> Populating transaction set with selected packages. Please wait.
---> Package psgml.noarch 0:1.2.5-4 set to be updated
--> Running transaction check
--> Processing Dependency: sgml-common for package: psgml
--> Restarting Dependency Resolution with new changes.
--> Populating transaction set with selected packages. Please wait.
---> Package sgml-common.noarch 0:0.6.3-17 set to be updated
--> Running transaction check

Dependencies Resolved

=============================================================================
 Package                 Arch       Version          Repository
Size
=============================================================================
Installing:
 psgml                   noarch     1.2.5-4          base
203 k
Installing for dependencies:
 sgml-common             noarch     0.6.3-17         base
41 k

Transaction Summary
=============================================================================
Install      2 Package(s)
Update       0 Package(s)
Remove       0 Package(s)
Total download size: 243 k
Is this ok [y/N]: y
Downloading Packages:
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID
db42a60e
public key not available for psgml-1.2.5-4.noarch.rpm
Retrieving GPG key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora

The GPG key at file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora (0x4F2A6FD2)
is already installed but is not the correct key for this package.
Check that this is the correct key for the "Fedora Core 4 - i386 - Base"
repository.

-- 
Dave Roberts <ldave at droberts.com>