gpg problems with shibboleth repo packages

[Cantor, Scott]

Your repository is not current, the second key was added years ago for cases where they were personally signed. There don't appear to be any ways to indirect it to pull from multiple keys via a single URL, making it impossible to predict when changes will be needed or automate them. For now they're all signed by me and I definitely know the original key won't ever be used again, but the specific set can never be stable.

-- Scott