Reported by Moritz Duge and Till Doerges from PRESENSE
==============
Sadly Kiwi doesn't warn be about unsigned repos or packages, even after
installing the Zypper update.
==============

I had a short look at Kiwi. In modules/KIWIManagerZypper.pm we have this snippet:

    #==========================================
    # Get signature information
    #------------------------------------------
    my $imgCheckSig = $xml -> getPreferences() -> getRPMCheckSig();
    if (! $imgCheckSig) {
        $imgCheckSig = 'false';
    }

So unless it's explicitly requested by the user signature checks are disabled. It should be the other way around.