Description of problem: Every time we add a new Channel, we may (or may not) add 'Security: GPG' information on the channels signing key; However these keys/values are not used afaik (I'd be pleased to be proven wrong). When deploying/adding a new software channel to a system, we still need to more or less manually deploy the signing key via rpm --import ./somekey because otherwise yum/... will complain about the unknown key. Now to the RFC: IF we already have all the information (the 'Security: GPG' section), why can't we automatically import a thus given key on a system where the software channel is added?
GPG key value is actually used by yum/dnf on client to import the key. However yum/dnf spacewalk plugin only allows to import keys from local /etc/pki/rpm-gpg/. This is for security reasons - you'd download both packages and a key from the (same) remote site then verification would be useless as attacker could forge both the packages and the key.