Subscription Manager now sets gpgcheck = 0 if it sees that the gpgkey URL is not set. (Previously this would have been set to 1, meaning the repo would not function at all in this scenario, unless they were manually importing gpg keys on all their clients.)
If someone uses custom content, not specifying a gpgkey URL when they set up their content, but manually importing the keys themselves on all clients, then gpgcheck is flipped to 0 after upgrading to the latest subscription manager, and they probably wouldn't even know.
This needs release noted in the entitlements section, something like:
Subscription Manager will now disable gpgcheck for any repositories it manages which have an empty gpgkey. To re-enable, you can upload your GPG keys, and ensure that the correct URL is added to your custom content definition.
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
Subscription Manager now disables gpgcheck for any repositories it manages which have an empty gpgkey. To re-enable the repository, upload the GPG keys, and ensure that the correct URL is added to your custom content definition.
Included in both 6.3 Release and Technical Notes.
Fix available on docs.redhat.com. Closing!