How about asserting that the gpg key for the newly created repository matches what you passed before the update?