In other words, it says the package is the problem, where it should you: hey, the Fedora.us key is missing, please import.
Should this be a bug in bugzilla? Or a feature request? (new ground to me).
Sounds a bit like it could be a known bug or deficiency. Checking http://bugzilla.redhat.com might answer whether it is known already. If it isn't and if you can demonstrate that the downloaded aalib package is really signed (rpm -Kv aalib*.rpm) and verifies as good, submitting a bug report shouldn't hurt anyone. Such misleading error messages are not good.
Ok, I checked but couldn't find this particular bug. I created bugnr 111210. (http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=111210)
Guus. -- A.J. Bonnema, Leiden The Netherlands, user #328198 (Linux Counter http://counter.li.org)