Good point. This is a really old code used for rpm and errata updates which I was reusing for applicability, so didn't really pay attention to it. I can at least think of an example of 'kernel' packages where we can have multiple versions of same package name and arch installed on a machine. Not sure whether there are other cases where it can happen. We may need to add version to the key in order to avoid collisions then.