epm-sh-functions: __epm_check_if_package_from_repo(): add check for empty Signature field

bin/epm-sh-functions

@@ -780,6 +780,10 @@ __epm_check_if_package_from_repo()
     distribution="$(epm print field Distribution for "$pkg" 2>/dev/null )"
     echo "$distribution" | grep -q "^ALT" || return
 
+    local sig
+    sig="$(epm print field sigpgp for "$pkg" 2>/dev/null )"
+    [ "$sig" = "(none)" ] && return 1
+
     # FIXME: how to check if the package is from ALT repo (verified)?
     local release="$(epm print release from package "$pkg" 2>/dev/null )"
     echo "$release" | grep -q "^alt" || return