Why do some repos fail the RPM package import with GPG errors? (Chrome, ProtonVPN)

[Repowave]

For example, using ProtonVPN's provided .repo:

[protonvpn-fedora-stable]
name = ProtonVPN Fedora Stable repository
baseurl = https://repo.protonvpn.com/fedora-$releasever-stable
enabled = 1
gpgcheck = 1
repo_gpgcheck=1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc

This doesn't look out of the ordinary from other repos that are working fine, but when trying to rpm-ostree install a package from the repo, it outputs the following error:

Importing packages... done
error: importing RPMs: package proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch cannot be verified and repo protonvpn-fedora-stable is GPG enabled: /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm could not be verified.
/var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm:  digest:  SIGNATURE:  NOT OK

Is there a misconfiguration in the repo, or the rpm trying to be acquired, or is this a bug in rpm-ostree?

No prompts to accept/import GPG keys occurs in Silverblue, for instance, as it does on Fedora Workstation.

[miabbott]

This kind of looks like an issue that was reported a while ago about how rpm-ostree handles GPG keys with subkeys (#1094 (comment))

$ gpg /etc/pki/rpm-gpg/protonvpn.asc 
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa3072 2020-10-28 [SC] [expires: 2024-12-15]
      A88441BD4864F95BEE08E63A71EB474019940E11
uid           Proton Technologies AG <opensource@proton.me>
sub   rsa3072 2020-10-28 [E] [expires: 2024-12-15]
pub   rsa3072 2024-03-20 [SC] [expires: 2025-03-20]
      9E72DFDF2AF019F0CCFC68F38DD48989F43719CA
uid           Proton Technologies AG <opensource@proton.me>
sub   rsa3072 2024-03-20 [E] [expires: 2025-03-20]
pub   rsa3072 2024-10-25 [SC] [expires: 2026-10-25]
      F20018AD1914638BC3B485F7413E4BA367FCBBBB
uid           Proton Technologies AG <opensource@proton.me>

$ rpm -qip /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm | grep Signature
warning: /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 67fcbbbb: NOKEY
Signature   : RSA/SHA256, Tue 05 Nov 2024 05:49:12 AM EST, Key ID 413e4ba367fcbbbb

But that was supposed to be fixed with rpm-software-management/libdnf#711 and #1819

@jlebon any ideas here?