dnf handles repo_gpgcheck=1 incorrectly. Where should I report it?

I see 3 issues with the current behavior:

1. dnf stores a separate copy of the key for each repo in the cache

2. dnf -y update will add keys without prompting the user

3. clearing the dnf cache drops the keys, exposing the system to 

STEPS TO REPRODUCE (USE CASE 1)

# dnf config-manager --save --setopt=*.repo_gpgcheck=1 appstream baseos extras powertools

# dnf  update

EXPECTED RESULT

dnf will call gpg to import the keys into root's keyring.

gpg will query the operator once for each key

dnf queries the operator once for each repo, loads that repo, then moves to the next repo. 

dnf stores the gpg keys under /var/cache/dnf, for example:

/var/cache/dnf/extras-2770d521ba03e231/pubring/trustdb.gpg

/var/cache/dnf/powertools-25a6a2b331e53e98/pubring/trustdb.gpg

/var/cache/dnf/baseos-929b586ef1f72f69/pubring/trustdb.gpg

/var/cache/dnf/appstream-a520ed22b0a8a736/pubring/trustdb.gpg

EXPECTED RESULT OF ref#3

dnf already has the keys

ACTUAL RESULT OF ref#3

dnf asks the operator to accept the same key 4 times

PROPOSED FIX

dnf's repo_gpgcheck should check the signature against keys in the user's keyring.

Key management should be done using gpg, not dnf.