❯ export temp_repo="$(mktemp -d)" GNUPGHOME="$(mktemp -d)"

❯ rsync -HSa rsync://rsync.gentoo.org/gentoo-portage/ "$temp_repo/"
Welcome to starling.gentoo.org / rsync.gentoo.org

Server Address : 81.91.253.252, 2a01:90:200:10::1a
Contact Name   : mirror-admin@gentoo.org
Hardware       : 2 x Intel(R) Xeon(R) CPU E5-2470 0 @ 2.30GHz, 3946MB RAM
Sponsor        : Qube Managed Services Limited, Zurich, Switzerland, EU

Please note: common gentoo-netiquette says you should not sync more
than once a day.  Users who abuse the rsync.gentoo.org rotation
may be added to a temporary ban list.

MOTD autogenerated by update-rsync-motd on Tue Oct 11 08:08:42 PM UTC 2022

❯ gpg --quiet --auto-key-locate clear,wkd --locate-external-keys infrastructure@gentoo.org releng@gentoo.org repomirrorci@gentoo.org openpgp-auth+l1@gentoo.org openpgp-auth+l2-srv@gentoo.org
pub   rsa2048 2019-04-01 [C] [expires: 2024-07-01]
      18F703D702B1B9591373148C55D3238EC050396E
uid           [ unknown] Gentoo Authority Key L2 for Services <openpgp-auth+l2-srv@gentoo.org>

pub   rsa2048 2019-04-01 [C] [expires: 2024-07-01]
      ABD00913019D6354BA1D9A132839FE0D796198B1
uid           [ unknown] Gentoo Authority Key L1 <openpgp-auth+l1@gentoo.org>

pub   rsa4096 2018-05-28 [C] [expires: 2024-07-01]
      EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
uid           [ unknown] Gentoo repository mirrors (automated git signing key) <repomirrorci@gentoo.org>
sub   rsa2048 2018-05-28 [S] [expires: 2024-07-01]

pub   dsa1024 2004-07-20 [SC] [expires: 2024-01-01]
      D99EAC7379A850BCE47DA5F29E6438C817072058
uid           [ unknown] Gentoo Linux Release Engineering (Gentoo Linux Release Signing Key) <releng@gentoo.org>
sub   elg2048 2004-07-20 [E] [expires: 2024-01-01]

pub   rsa4096 2011-11-25 [C] [expires: 2024-07-01]
      DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
uid           [ unknown] Gentoo ebuild repository signing key (Automated Signing Key) <infrastructure@gentoo.org>
sub   rsa4096 2011-11-25 [S] [expires: 2024-07-01]

❯ gemato verify --debug "$temp_repo/"
ERROR:root:OpenPGP verification failed:
gpg: Signature made Do 17 Nov 2022 17:39:52 UTC
gpg:                using RSA key E1D6ABB63BFCFB4BA02FDF1CEC590EEAC9189250
gpg: Note: signatures using the SHA1 algorithm are rejected
gpg: WARNING: signing subkey EC590EEAC9189250 has an invalid cross-certification
gpg: Can't check signature: General error