to take a slightly different tack on this issue, would it make sense to put the rhwas rpms into a different repo than centosplus? since the rhwas stuff does come from upstream, it is a little less dangerous than the other things that go into centosplus.