How to verify Unman's template

There’s something wrong with your rpm handling. It may be because
you’re running an update, but probably not.

Try running :

  1. rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
    That will give you a list of keys, with output like:
    gpg-pubkey-c8c0c2ef-576dd3b7 unman (Qubes OS signing key)

Then use the identfier to remove the key:
2. rpm -e gpg-pubkey-c8c0c2ef-576dd3b7

Check that the key has been removed by running 1 again.

Now start again. Check that the key you have in /etc/pki/rpm-gpg/ is up
to date. Import that key:
3. rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-unman

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.