Use local mirror for R binary RPM packages?

[elendil95]

Hi,
I am trying to use rig to manage R versions at my job, but ive run into some issues: we have several servers running RHEL 8/9 which are air-gapped, and do not have access to the public internet, so we mantain a private package repository.
My questions are as follows:

1. When installing rig itself, i get warnings from yum saying the rig rpm package is not GPG signed: is there a gpg key i need to import? the debian install instructions in the readme have a GPG key for the debian repo, but that seems to not be the case for rpm-based distros since the instructions say i should grab the rpm package from the github releases. If there is a separate GPG key i should use, do let me know.

2. When adding R versions with rig add, rig fetches R packages from https://cdn.posit.co/r/centos-8/pkgs/. I've had a cursory look through the project and there seems no way to override this, but i could be wrong. Could it be possible to add this feature? I am also willing to send in a PR to fix this, but i am not at all familiar with Rust development

3. The same GPG sig versification error also happens when dnf attempts to install R rpm packages from https://cdn.posit.co/r/centos-8/pkgs. I tried following the instructions for importing GPG keys detailed on https://posit.co/code-signing/ but it didn't work, and im not sure if im on the right track. Any advice would be appreciated :)