split repo_find_pubkeys from repo_verify_sigdata