Comment # 21 on bug 906589 from grant k

fyi, even with

    gpg --version
        gpg (GnuPG) 2.0.26
        libgcrypt 1.6.2

I notice, e.g.

    zypper -v dup
        ...
        Checking whether to refresh metadata for MediaApps
        Retrieving: repomd.xml
................................................................................................................................................................................................................[done]
        Retrieving: repomd.xml
................................................................................................................................................................................................................[done]
        Retrieving: repomd.xml.asc
............................................................................................................................................................................................................[done]
        Retrieving: repomd.xml.key
............................................................................................................................................................................................................[done]
        Retrieving: repomd.xml
................................................................................................................................................................................................................[done]

        New repository or package signing key received:

          Repository:       MediaApps                                           
          Key Name:         multimedia OBS Project
<multimedia@build.opensuse.org>
          Key Fingerprint:  01FB54D4 EAF87B0F 5624266B 5F3D540F 3A802234        
          Key Created:      Wed 21 May 2014 02:04:08 PM PDT                     
          Key Expires:      Fri 29 Jul 2016 02:04:08 PM PDT                     
          Rpm Name:         gpg-pubkey-3a802234-537d14c8                        


        Do you want to reject the key, trust temporarily, or trust always?
[r/t/a/? shows all options] (r): 
        ...

so, WHY is that repo getting a "New repository or package signing key" ?

Checking, both the 'main' repo, 

    Index of /repositories/multimedia:/apps/openSUSE_13.2/repodata

    Icon  Name                                                                 
            Last modified      Size  [DIR] Parent Directory                    
                                                                  -   
    [   ]
3e49d56308b8b1bc86e6959810784dd05212edf72309161edd2dca817935d43a-app-icons.tar.gz
27-Nov-2014 20:26   22K   Details
    [   ]
12b6d5e97ce334c91153af0eb61fafebcc3356018dd035cd388e987bf14ab050-filelists.xml.gz
27-Nov-2014 20:26  717K   Details
    [   ]
176dec0bb9018624afece974d116af178bb39b9afb90879890109811d2d27ad6-primary.xml.gz
  27-Nov-2014 20:26  247K   Details
    [   ]
7339fbd3c2685f39a3d7907e1cdff121f0b5882546bc1aeb17a20cef4f4f8588-appdata.xml.gz
  27-Nov-2014 20:26  4.4K   Details
    [   ]
abd1ce2e154a61067d510611ae274f5182d449292887880f0f9b8d1d321897f9-other.xml.gz  
  27-Nov-2014 20:26  370K   Details
    [TXT] repomd.xml                                                           
            27-Nov-2014 20:26  2.4K   Details
    [   ] repomd.xml.asc                                                       
            27-Nov-2014 20:26  189    Details
    [   ] repomd.xml.key                                                       
            27-Nov-2014 20:26  1.0K   Details

    Apache/2.2.12 (Linux/SUSE) Server at download.opensuse.org Port 80

    MirrorBrain powered by Apache

and an arbitrarily selected mirror,

    Index of
/mirrors/download.opensuse.org/repositories/multimedia:/apps/openSUSE_13.2/repodata

    Icon  Name                                                                 
            Last modified      Size  Description[DIR] Parent Directory         
                                                                             -  
    [   ]
3e49d56308b8b1bc86e6959810784dd05212edf72309161edd2dca817935d43a-app-icons.tar.gz
27-Nov-2014 19:26   22K  
    [   ]
12b6d5e97ce334c91153af0eb61fafebcc3356018dd035cd388e987bf14ab050-filelists.xml.gz
27-Nov-2014 19:26  717K  
    [   ]
176dec0bb9018624afece974d116af178bb39b9afb90879890109811d2d27ad6-primary.xml.gz
  27-Nov-2014 19:26  247K  
    [   ]
7339fbd3c2685f39a3d7907e1cdff121f0b5882546bc1aeb17a20cef4f4f8588-appdata.xml.gz
  27-Nov-2014 19:26  4.4K  
    [   ]
abd1ce2e154a61067d510611ae274f5182d449292887880f0f9b8d1d321897f9-other.xml.gz  
  27-Nov-2014 19:26  370K  
    [TXT] repomd.xml                                                           
            27-Nov-2014 19:26  2.4K  
    [TXT] repomd.xml.asc                                                       
            27-Nov-2014 19:26  189   
    [TXT] repomd.xml.key                                                       
            27-Nov-2014 19:26  1.0K  

    Apache/2.2.12 (Linux/SUSE) Server at anorien.csc.warwick.ac.uk Port 80

have the same key data ... recently timestamped, if not changed.

Why is this (or any such ...) repo getting 'new' keys?  Is it intended, or is
it a bug?