Should the RPM repository enable gpgcheck=1 by default?

[tanmaymohan]

Question

The current NVIDIA Container Toolkit RPM repository configuration enables repository metadata verification but disables RPM package-signature enforcement:
ini
repo_gpgcheck=1
gpgcheck=0
Is gpgcheck=0 required for compatibility with older packages or distributions, or could the repository enable gpgcheck=1 by default?

Test environment

Amazon Linux 2027 Public Preview 2027.0.20261026
Architecture: x86_64
DNF5
NVIDIA Container Toolkit 1.20.1-1

Test performed

After importing the repository’s published GPG key and changing only gpgcheck to 1, DNF successfully installed:

nvidia-container-toolkit
nvidia-container-toolkit-base
libnvidia-container1
libnvidia-container-tools
I also downloaded the four RPMs directly and ran:
bash
rpmkeys --checksig --verbose *.rpm
Each package reported:

OpenPGP V4 RSA/SHA512 header signature: OK
Header SHA256 digest: OK
Payload SHA256 digest: OK
Signing-key fingerprint: C95B321B61E88C1809C4F759DDCAE044F796ECB0

Expected guidance

This is not a report of an installation failure or vulnerability. I am trying to understand the intended repository policy.

Since the current packages verify successfully, would enabling gpgcheck=1 by default be appropriate? If not, documenting the compatibility reason would be helpful.