We need upstream to backport the fixes to the 4.16.x branch:
https://github.com/rpm-software-management/rpm/pull/1788#issuecomment-1030591355

RedHat has already done it in CentOS 9 Stream in this commit:
https://git.centos.org/rpms/rpm/c/3f3ddd0c8927e60ed546707bac1303a44035f0ec?branch=c9-beta

It's rpm-4.16.1.3-validate-and-require-subkey-binding-sigs.patch

Status comment: (none) => Patch available from RedHat

upstream patch: 

https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8

CC: (none) => mageia

src:
    - rpm-4.16.1.3-1.2.mga8

Status comment: Patch available from RedHat => (none)
Assignee: thierry.vignaud => qa-bugs

rpm-4.16.1.3-1.2.mga8
librpm9-4.16.1.3-1.2.mga8
rpm-build-4.16.1.3-1.2.mga8
python3-rpm-4.16.1.3-1.2.mga8
librpmbuild9-4.16.1.3-1.2.mga8
librpm-devel-4.16.1.3-1.2.mga8
librpmsign9-4.16.1.3-1.2.mga8
rpm-sign-4.16.1.3-1.2.mga8
rpm-plugin-systemd-inhibit-4.16.1.3-1.2.mga8
rpm-plugin-prioreset-4.16.1.3-1.2.mga8
rpm-plugin-audit-4.16.1.3-1.2.mga8
rpm-plugin-selinux-4.16.1.3-1.2.mga8
rpm-plugin-ima-4.16.1.3-1.2.mga8
rpm-plugin-syslog-4.16.1.3-1.2.mga8
rpm-cron-4.16.1.3-1.2.mga8
rpm-apidocs-4.16.1.3-1.2.mga8

from rpm-4.16.1.3-1.2.mga8.src.rpm

Tested in VirtualBox.

No installation issues using qarepo. Tested by running rpmdrake and installing several games. No installation issues with the games, dependencies were identified and installed without incident. 

I ran each of the games, and each worked, except one, Bitfighter. That one had a popup that the version is old, and that's about it. (Filing a bug) I then used rpmdrake once more to remove the games, without incident.

Giving this an OK, and validating.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0321.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED