RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)
{ "section": "core" }
"https://advisories.mageia.org/MGASA-2022-0321.json"