Comment # 1 on bug 1188488 from Andreas Stieger

As for the transient problem: Rejecting a signature that does not validate is
expected behavior. This may be due to the particular mirror. Which is why we
recommend the use of download.opensuse.org for two reasons: 1. it served the
metadata and 2. it only redirects to mirrors for files that are known to exist
on it.

For your deployment, which seems to be a site of non-trivial site, you should
create a private mirror and use that. You can likewise get registered to get
your clients redirected from download.opensuse.org without incurring external
traffic.