The cryptographic signature of an RPM can be verified with the
rpm -K command. This returns a string containing
pgp) and ending in
OK if the signature is in RPM's database and is valid.
If the package is not signed but the checksums are valid, you'll still get
OK, but no
If the package is signed but the key is missing from the RPM database, you get
(GPG) (capital letters) and
NOT OKAY, followed by
(MISSING KEYS: GPG#deadbeef).
That's handy if I want to figure out what key I should find to install to make my package installation work.
But what if I want to verify which of several keys in my RPM keyring was used to sign a given package?