1. --verify doesn't include the Fedora built, and it now should. 2. sign catches any artifacts from rcs as well in the sha256sums.