In other words, it says the package is the problem, where it should you:
hey, the Fedora.us key is missing, please import.
Should this be a bug in bugzilla? Or a feature request? (new ground to me).
Sounds a bit like it could be a known bug or deficiency. Checking
http://bugzilla.redhat.com might answer whether it is known already. If
it isn't and if you can demonstrate that the downloaded aalib package is
really signed (rpm -Kv aalib*.rpm) and verifies as good, submitting a
bug report shouldn't hurt anyone. Such misleading error messages are not
good.