We should implement a check that all packages are signed. We should probably run this at the end of the deployment tests (install_default_upload etc). See https://bugzilla.redhat.com/show_bug.cgi?id=2356237 .