File 'repomd.xml' from repository 'zrepl' is unsigned.

[findesgh]

When I add and refresh the zrepl-rpm-repo on openSUSE Tumbleweed or Leap, it complains about the master index file being unsigned:

Warning: File 'repomd.xml' from repository 'zrepl' is unsigned.

    Note: Signing data enables the recipient to verify that no modifications occurred after the data
    were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
    and in extreme cases even to a system compromise.

    Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
    whole repo.

    Warning: We can't verify that no one meddled with this file, so it might not be trustworthy
    anymore! You should not continue unless you know it's safe.

This does not happen on Fedora. I don't know enough about dnf or zypper to understand what the difference/cause is. Surely this is not a check which dnf simply skips?

To reproduce:

podman run -it opensuse/tumbleweed /bin/bash

cat > /etc/zypp/repos.d/zrepl.repo <<EOF
[zrepl]
name = zrepl
baseurl = https://zrepl.cschwarz.com/rpm/repo
gpgkey = https://zrepl.cschwarz.com/rpm/rpm-key.asc
EOF

zypper ref