Use gpg keys from the os repos since those are always available, and line up with the repo being used to run the content from
we dont use epel anymore
deliver the ostree update repo path via the centos-release-atomic rpm