
If a repo was configured with a fingerprint, but it has not yet updated and gotten the pubkey from the index.jar, then it will be in an "unverified" state, i.e. the signing key fingerprint is stored, but it has not yet been used to check against the pubkey in the index.jar