openSUSE: repomd.xml was modified after it has been signed warning

After adding the Keybase repo to openSUSE (Tumbleweed), I get a verification warning on the `repomd.xml` file because `This file was modified after it has been signed`. This doesn't seem to be a warning/error that can be ignored or skipped, and shows each time I want to update packages.

- Adding GPG key:

`sudo rpm --import 'https://keybase.io/docs/server_security/code_signing_key.asc'`

- Adding repo:

`sudo zypper addrepo --gpgcheck --refresh 'http://prerelease.keybase.io/rpm/$basearch' 'Keybase'`

- Updating packages:

`sudo zypper dist-upgrade`

```
Retrieving repository 'Keybase' metadata ------------------------------------[\]
Signature verification failed for file 'repomd.xml' from repository 'Keybase'.

Note: Signing data enables the recipient to verify that no modifications
occurred after the data were signed. Accepting data with no, wrong or
unknown signature can lead to a corrupted system and in extreme cases even
to a system compromise.

Note: File 'repomd.xml' is the repositories master index file. It ensures
the integrity of the whole repo.

Warning: This file was modified after it has been signed. This may have been
a malicious change, so it might not be trustworthy anymore! You should not
continue unless you know it's safe.

Signature verification failed for file 'repomd.xml' from repository 'Keybase'. Continue? [yes/no] (no):
```

With the suggestion at https://github.com/openSUSE/zypper/issues/70, if I add the repo with `--no-gpgcheck `instead of `--gpgcheck`, the error doesn't show. But I assume GPG checking the repo would be more ideal for security reasons.

Reproduce the warning using the listed rpm import, zypper addrepo, and zypper dist-upgrade commands on openSUSE Tumbleweed. Investigate why the Keybase repository's repomd.xml fails signature verification; done means the repository can retain GPG checking without the reported warning.

Written by the indexing model from the issue text.